refactor: implement governed Delivery program contracts

Merge pull request 'refactor: implement bounded Delivery existing-owner simplification' (#13 ) from refactor/delivery-existing-owners into test
refactor: simplify Delivery through existing procedure owners
2026-10-23 06:39:27 +00:00 · 2026-10-22 22:16:23 -07:00 · 2026-10-23 05:12:21 +00:00 · 2026-10-21 10:58:12 -07:00
20 changed files with 711 additions and 212 deletions
@@ -0,0 +1,77 @@
+# Full-program responsibility consolidation
+
+Authorization: Piotras Board approval, [full approved program](https://discord.com/channels/1518726359512387766/1546489551235588138/1563064779772526616), as cited by the coordinating task. This local consolidation and canonical dependency binding makes no remote/runtime write, commit or publication. `SIMPLIFICATION.md` remains the historical minimum record.
+
+The subsequent `contracts-audit.md` authority report was read in full and the coordinating instruction adopted its mechanical A05/A06/A08 mappings and A17 chronology. Only A02/A04 remain unresolved policy choices; A17 later-resumption evidence remains a bounded discovery gap.
+
+## Effective baseline and publication gate
+
+The installed `development-gates` 1.1.0 entry and review/CI reference carry complete-job-inventory, required aggregate and single-attempt safeguards; installed `devsecops-ci-cd-gitea-aerosim` 1.2.0 plus pipeline/conventions/Harbor references carry candidate image/chart packaging and aggregate inputs. Those inspected installed packages are the effective baseline, not unpublished additions in sibling worktrees. A separate worker reconciles their source packages. Before publication/adoption, verify complete published owner packages include these safeguards and record immutable revisions; this local result does not claim that reconciliation, publication or runtime refresh succeeded.
+
+Exact-worktree/process-CWD checks and API task/run/UI identifier distinction remain in planning reconciliation: the inspected owners do not yet fully carry them. Likewise exact-context preflight and base-image consumer/repair contracts remain here. No unmatched safeguard was removed merely because a destination seems plausible.
+
+## Clause-level disposition
+
+| Finding | Implemented responsibility / retained clause / bounded remainder |
+|---|---|
+| A01 | Gate reference loads `development-gates` and its review/CI contract at candidate/CI/merge/integration decisions; attempt integrity and integration mechanics delegated. Six gate codes, all required validation classes, reviewer bindings, state transitions, deployment and handoff exits retained. A02/A04-sensitive sequence clauses retained rather than silently rewritten. |
+| A02 | **unresolved**: substantive push-versus-review order. Existing stage 3 steps 5–6 retained; empty kickoff visibility is not a resolution. Await separate exact owner/Board resolution before affected extraction or conflicting execution. |
+| A03 | Existing reviewer override preserved: main runtime reviews its candidate; AeroSim active worker reviews, main independently verifies evidence/remote effects. No second review worker or human-review dependency introduced; packet verification is not independent code review. |
+| A04 | **unresolved**: harmless-base-drift clause versus generic synchronize/re-review. Stage 4 steps 2–3 retained and conflict explicitly bounded; no new harmless-drift exception inferred. |
+| A05 | Removed stale “when practical” exemptions. AeroSim runtime binds observed product-reason unit RED, minimal GREEN/REFACTOR, isolated unpublished-delta discard only, preservation of unrelated/shared/integrated work, forward repair and honest historical missing RED. RootAtSkic alone grants a documented exception; no retrospective compliance. Central retains the same bounded discard/shared-work safeguard with its own project-authority exception; the generic owner update is coordinated separately. |
+| A06 | AeroSim worker contract now distinguishes durable coordination of the complete frozen wave from executable per-Task claims: ledger includes blocked/unadmitted members without promotion, one live worker per eligible Task, canonical documentation persistence, verified lock ownership and orphan recovery. Per-Task gate ordering preserves authorized independent parallelism. No new status/admission gate or invented schema. |
+| A07 | Planning/status/pitfalls load exact gates/integrity owners instead of repeating checkpoint algorithms. Retain Task-row semantics, current versus historical admission, non-approval interpretation, wave header/all-Task chapter, gate codes, source destinations and duplicate suppression. Full validator/build and exact-worktree residual checks retained. |
+| A08 | AeroSim binds one focused repair attempt or one hour (whichever first) to sole-executor evidence handoff to main, existing-domain-owner advice, same-gate safe forward repair and continued independent Tasks. Advice is not a second implementer/reviewer; worker replacement needs verified ownership loss and durable handover. Central generic role mapping is coordinated separately; no project authority broadening. |
+| A09 | AeroSim Actions reference is now overlay + exact CI owner/reference loads, not three duplicate workflow trees. Retains exact workflow names, all-app/code/image/chart/aggregate outcomes, credential and UAT boundaries. Runtime publication mechanics route to that owner; chart/GitOps integration bindings remain. Publication-ready owner verification is a hard prerequisite, not an assumption from sibling source edits. |
+| A10 | Already resolved; preserve Delivery static/build-time artifact validations and candidate image/chart packaging. All functional non-unit suites remain UAT-owned; E2E never installs Helm or builds/publishes images. |
+| A11 | Exact Task-release/unpadded-attempt branch naming, early visible PR, card links where applicable, `test` base, title equality and standing AeroSim merge delegation preserved. Generic branching cannot overwrite these project policies. |
+| A12 | Board remains sole shared-login owner with decision-point load and fail-closed behavior. Specialist recovery load remains; exact own-account delegation, all stricter preconditions, transport interlocks, code guards and three-layer readback retained byte-identically. Recovery publication provenance remains unverified; no invented repository mapping. |
+| A13 | Replaced repeated dataset/NFS/PV recipe with mandatory `home-v1--truenas` + `references/gondor-retained-application-storage.md` load before storage work. Durable non-deleting storage, environment isolation, approved authority and deployment-readiness remain. Selected Gondor skill and both AeroSim fallbacks retained; canonical GitOps, compatibility alias and generic base are installed and skill_view-tested by the parent, source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. No live StorageClass assertion. |
+| A14 | Gate preflight now loads the one retained runtime preflight. Runtime loads scripts/monorepo owners for repository-root execution and committed versions. Task/cache isolation, every execution context and repository-native complete validation retained. AeroSim nested-pnpm recovery routes to its verified documentation owner; central fallback retained because global same-name source identity is unresolved. |
+| A15 | Domain coverage remains Delivery-owned: five Ways of Working and five Engineering sections, verified not aspirational practice. Decision-point Docusaurus/Glossary loads own authoring/build/term mechanics. Removed duplicate synchronization enumeration in favor of entry/planning owners; no new documentation helper. |
+| A16 | Duplicate evidence/toolchain pitfalls become owner loads. Retain project lock-holder verification and complete base-image contract including credential-free candidate checks, trusted publication, immutable digest consumption and last known-good forward repair. No CI-owner ownership of that unmatched contract asserted. |
+| A17 | Authority audit found original RootAtSkic hourly/60-minute requests (1546990225669234820, 1550892376900509817) and explicit stop (1552094167901937676). AeroSim entry replaces unconditional scheduling with conditional mechanics and a versioned approval/stop/resumption record. Later bot-reported reconciler 6777dc7d3d82 does not prove reauthorization or current inventory; bounded resumption evidence remains outstanding. No scheduler mutation or unauthorized-job finding. See entry chronology for exact links. |
+| A18 | Eight-channel wording corrected in AeroSim gates; authorized channel boundary unchanged. Worker cache diagram no longer places Playwright/PostgreSQL under Delivery. DEV tuple, UAT verdict and verified separate Releases-channel handoff remain distinct; no `DONE` or release authority moved. |
+
+## Verification contract
+
+Tests precede content edits. Whole-file hashes for intentionally thinned references are replaced with checks of exact protected clauses plus semantic routing/outcome tests, not with deletion of safety coverage. Unchanged metadata, authority blocks, self-recovery source and delegation guards retain original hashes. Run every test module (including standalone `main()` scripts), the recovery tests with their declared websocket dependency, local Markdown-link validation and `git diff --check`. Report local results only; no repository CI or publication is implied.
+
+## Original consolidation verification result
+
+- Command: `/opt/hermes/.venv/bin/python tests/verify_full_program.py` — **21 checks passed**, including standalone test functions/main scripts that unittest discovery alone misses.
+- Local operational Markdown links: **29 resolved**; `git diff --check` passed.
+- Entry + all references: **80,924 → 76,537 bytes** (4,387 fewer). References alone: **57,907 → 53,520 bytes** (4,387 fewer). Audit records and tests excluded; new authority chronology/mappings are included. This is a measured reduction, not a dramatic token-saving claim.
+- Plain system Python lacked `websockets`; the existing Hermes venv supplied it. No dependency installation or runtime skill update was performed.
+- No remote CI/publication, live deployment, scheduler or account mutation was attempted. Required dependency publication readback and A02/A04 owner choice remain coordinating gates.
+
+## Canonical dependency acceptance update
+
+The parent reports merged and installed owner packages: `development-gates` at `02e716ddff053c71a921839419ed2bd2334f1e67`, `development-integrity` at `3ca0fbb284b5eb194ad5ff1f2756f1fde0077c6a`, `development-method-ttd` at `d3d91be7bb2926b0f1bd16db60c0fe2250ed8d39`, and `development-durable-wave-execution` at `a180018ef3bc337bb1fbabd095fa7a4e13471fc5`. This supersedes their earlier pending reconciliation description above; it is coordinating evidence, not a runtime action performed here. GitOps canonical `development-gitops-argo-cd-home-gondor-v1`, alias and generic base were installed and skill_view-tested by the parent at source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. Conditional fallbacks remain for unavailable future installations. Other canonical owners are being published by the parent; no unverified publication success is inferred. Legacy source URLs and historical records remain provenance, not additional owners. `corp-v1-glossary` remains unchanged pending the public-to-private repository decision. A02/A04 still await human resolution.
+
+Canonical-binding verification: see [naming-delivery-review.md](naming-delivery-review.md) for the subsequently executed complete standalone harness results and unchanged golden-hash strategy.
+
+## Final bounded owner consolidation
+
+This supersedes the earlier A14/A16 statements that reusable preflight/base-image mechanics lack an owner. Delivery retains the project bindings and outcomes; only the matched mechanics moved. A02/A04 and their golden clauses remain unchanged and unresolved.
+
+| Moved reusable clause | Exact source-owner section |
+|---|---|
+| version resolution, executable/version comparisons | `development-scripts/references/runtime-preflight.md` — Required inputs; Procedure 1–2 |
+| presence-only environment and repository identity/state checks | `development-scripts/references/runtime-preflight.md` — Procedure 3–4 |
+| same-context activation, inheritance failure classification and complete retry | `development-scripts/references/runtime-preflight.md` — Procedure 5; Failure and repair |
+| image folder/metadata, digest/tool/platform/user/workspace/trust assertions and lockfile parity | `devsecops-ci-cd-gitea/references/base-images.md` — Construction and static contract |
+| credential-free candidates and isolated trusted publication | `devsecops-ci-cd-gitea/references/base-images.md` — Candidate isolation and trusted publication |
+| full-source tags, direct Harbor readback, immutable retry and aggregates | `devsecops-ci-cd-gitea/references/base-images.md` — Immutable publication and direct readback |
+| digest consumer verification and forward repair mechanics | `devsecops-ci-cd-gitea/references/base-images.md` — Consumer verification and forward repair |
+| negative trigger/tag/secret/interpolation/digest/setup regression cases | `devsecops-ci-cd-gitea/references/base-images.md` — Fail-closed regression matrix |
+
+Immutable CI-owner acceptance: source `669e28eadfe79ac7cb3c10ccdea318dd5296d481`; installed/source base-image reference SHA-256 `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`, independently compared locally. `owner-responsibility.json` covers both callers. Scripts source was inspected at HEAD `5960d5e74713e6b95a403962f479b2b97cb76286`, with reference content SHA-256 `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the content hash, not HEAD alone, identifies the inspected working-tree contract. Scripts semantic reconciliation/publication/install remains a parent gate before Delivery publication/adoption. Record the final immutable published revision and source/runtime equality there; no pending result is claimed here.
+
+Retained locally: every foreground shell/worktree/background process/worker/main review/CI context, stop-on-failed-preflight, selected Task containment/repository/revision/namespace and allowed command scope, complete repository CI, trusted `test` branch and named project base-image repository, immutable consumer evidence, separate UAT acceptance, forward repair and last known-good digest. All unique project chart/runtime/storage/recovery boundaries remain unchanged.
+
+Test manifest: `tests/owner-consolidation-manifest.json` preserves inspected owner text/hash and exact clause-to-section moves. Only the two intentionally moved runtime section hashes are retired into that manifest; semantic regression checks replace them. All unrelated golden hashes and canonical identity normalization are unchanged. New tests first failed on missing decision-point loads in both packages, before content edits.
+
+## Published owner adoption checkpoint
+
+The final preflight owner is `global-skills/development-scripts` at `0e36552938da94c0539e39b35256b8effe34c25d`; the base-image owner is `global-skills/devsecops-ci-cd-gitea` at `669e28eadfe79ac7cb3c10ccdea318dd5296d481`. Both complete packages were authenticated-readback verified and installed byte-for-byte. The preflight hash is `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the base-image hash is `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`. Earlier preparation-stage pending-owner statements above are historical and superseded by this checkpoint. Generic scripts preserves the existing Home/SKIC adoption body in a scoped reference; it does not silently replace the adopted bootstrap convention. No remote CI was configured for these two owner repositories; local contract tests and independent source review passed. This checkpoint resolves the owner-publication prerequisite only, not A02/A04, scheduler reauthorization, remaining organization visibility or other-project adoption decisions.
@@ -0,0 +1,75 @@
+# Bounded Delivery simplification — 2026-10-23
+
+## Authority and boundary
+
+GUILD-IMP-20261023-delivery-existing-owners. Piotras (`501954115690168321`), verified Board member, approved “implement delivery skills proposal” in [Guild message 1563054836508008539](https://discord.com/channels/1518726359512387766/1542596418215092264/1563054836508008539), as supplied by the commissioning parent. This record does not claim an independent Discord re-audit.
+
+Implements only the [published recommendation / smallest useful change](https://pages.apps.lego-cloud.eu/corp-v1-aerosim/corp-v1-aerosim-documentation/engineering/skills-delivery-channel#smallest-useful-change), read from `delivery-proposal-refresh-20261023/engineering/skills-delivery-channel.mdx`, with [2026-10-23 source/finding evidence](https://pages.apps.lego-cloud.eu/corp-v1-aerosim/corp-v1-aerosim-documentation/evidence/delivery-skills-refresh-2026-10-23.json). Baseline: `225ae3b068d97748af69597353479eb9c26579fc`, version 1.14.1; candidate 1.14.2.
+
+Central package only; no helper, dependency change, file removal, migration, policy choice, dependency-repository edit or documentation-project edit. This manifest is an audit artifact, not an operational loaded reference. Parent owns publication, runtime refresh and separately authorized semantic project adoption.
+
+## Responsibility manifest
+
+Each row states the old rule/location, retained or single owner, and the new load point. Unlisted operational paragraphs remain unchanged.
+
+| Rule / before | After: owner and decision point | Retained outcome / limit |
+|---|---|---|
+| Login origin and authorized purpose — entry + runtime repeated Board policy | Board **Corp v1 System SSO Credential Use**; entry says load before login, runtime follows that binding | Origin/purpose verification remains mandatory; unavailable owner stops login |
+| Login secret names/runtime-only use — same two copies | Board; same pre-login load | Exact names retained in entry; no secret values introduced |
+| No inspect/print/hash/serialize/paste/log/screenshot/persist or unsafe transport — same copies | Board full policy, not a selected subset | Board rules 2–3 and 7–8 retain all restrictions and session safety |
+| Missing secret names only; never ask for values — same copies | Board rules 2–4, pre-login load | Injection only, no fallback secret |
+| Login is not account/credential/MFA/permissions/billing/destructive authority | Board plus short Delivery boundary | No recovery or additional authority granted |
+| Canonical lifecycle vocabulary repeated entry + status reference | Existing status reference owns full vocabulary; entry loads it before status action | Exact Task admission/claim, separate BLOCKED, TO_BE_RELEASED vs DONE retained in entry; full statuses unchanged in reference |
+| Ways of Working five sections repeated entry + failure reference | Existing failure reference owns domain coverage; entry loads it before edits | All ten domain sections remain; verified practice only, not aspirations |
+| Documentation platform mechanics | Global Docusaurus + project overlay; failure reference before authoring/validating | Source identity must match, not unrelated same-name VSSA installation; no domain/Diátaxis conflation |
+| Canonical reusable definitions | Existing global Glossary; failure reference before defining terms | Final top-level Glossary and domain links, not copied explanations |
+| Nested pnpm/Corepack bootstrap recipe — planning step 5 | Retained unchanged locally pending resolution of global Docusaurus runtime identity | Published owner has the procedure, but the installed name currently resolves to an unrelated source; no extraction to an unverified runtime owner |
+| Current checkpoint/report claims — planning steps 8/12 | Integrity evidence-first sequence; explicit before-report load in planning/status | Fresh source/merge distinction, revalidation on drift/merge/close, final equality and duplicate suppression retained locally |
+| Report shape and lifecycle meaning | Delivery status reference remains owner | Requested wave header, every Task, real owner, linked PR, gate codes, failure classification and no automatic DONE unchanged |
+| pnpm/script implementation routing — runtime Coding | Existing pnpm and scripts owners with source-table link and action triggers | Approved Feature/Task, structure/namespace, traceability, no unrelated refactor/fabrication remain |
+| Unit mechanics — runtime Unit testing | Explicit TTD action load added; existing generic owner already routed in entry | Existing bullets and Task stage left intact; no choice on discard/forward repair |
+| Failure diagnosis/forward-repair procedure repeated entry + failure reference | Existing failure reference; entry loads at observed failure | Complete reference repair and escalation text unchanged, including no premature stop/help-policy rewrite |
+| Build/CI failure classes repeated runtime + entry | Entry owns classes; runtime loads it and Integrity before reporting | Task CI job inventory and exact-head requirements untouched |
+| Base-image policy repeated entry + runtime | Existing runtime reference owns complete contract; entry loads before create/publish/consume | Digest, version/platform/non-root/tools, candidate secret isolation, immutable publication/readback, fail-closed tests, lockfile parity, separate layers, forward repair/last-good all retained |
+| Pitfalls duplicated entry + reference | Existing pitfalls reference, loaded on failed/resumed work and before status | Full reference unchanged; no safeguarding rule deleted |
+
+## Verified existing sources
+
+Source audit used the published capture, not version-label equality. No owner content was copied into a new helper or changed in this task.
+
+- [Board login owner](https://gitea.lego-cloud.eu/skic-skills/channel-board-skic/src/commit/9170a6749f0adf5ec65fc99a645600cb471be9f1/SKILL.md): published/installed equal in evidence; loaded for comparison.
+- [Integrity reporting owner](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity/src/commit/b677c99f24cbe83734a9d6a495e388837fc88701/SKILL.md): published/installed equal; loaded for comparison.
+- [Global Docusaurus](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus/src/commit/699cf6786e02bef74e84ec64b5a6233d4839ed47/SKILL.md): full captured `remote_text` read from `delivery-refresh-evidence/documentation-source.json`, including nested-pnpm remedy. Direct unauthenticated fetch returned 404; no false live-readback claim. Skill loader resolves a different VSSA owner; operational loads now explicitly require correct provenance.
+- [Glossary](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/corp-v1-glossary/src/commit/24732bf6864a14f2d6aa6cccd7d9fc023438a42d/SKILL.md): retained existing route; no glossary procedure extracted.
+- [TTD](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-method-ttd/src/commit/2155b0a250cea282bf6628231d8e3de286522a86/SKILL.md): retained strict existing route, no discard-policy rewrite.
+- Ordinary Git, pnpm and scripts source links remain in the unchanged Development Skill Routing table. No Git procedure is extracted because exact Task/branch/readback requirements are tightly coupled to unresolved gates.
+
+## Deferred findings and untouched boundaries
+
+A01: no gate algorithm extraction; published `development-gates` lacks installed complete-job-inventory protections. A02/A04: substantive push/review order and harmless-base-drift wording untouched. A03: main-session review/worker restrictions unchanged. A05: strict TTD route retained, weaker wording/local-discard versus valid-work forward repair not reconciled. A06: whole-wave claim mapping not chosen. A08: no help-threshold/worker-role decision. A09: project CI source/runtime drift not changed. A10: no obsolete Helm fix needed; current static artifact versus functional UAT boundary retained. A11: exact branch/title/attempt/early-PR identity untouched. A12: no recovery skill or authorization change. A13: GitOps loadability/storage source issues not solved; all runtime/storage safeguards retained. A14: exact-context preflight remains byte-identical. A15: domain/platform distinction retained. A16: base-image safeguard remains local, not delegated to an incomplete external owner. A17: no scheduler authority conclusion or job mutation. A18: central eight-channel boundary unchanged; no project cleanup here.
+
+The four complete files `task-delivery-gates.md`, `repository-entry-and-visibility.md`, `common-pitfalls.md`, `aerosim-lessons-review.md` are byte-identical. Runtime workspace, exact-context preflight/base-image/runtime-resource tail, failure-repair procedure and entry Authority/Escalation are hash-locked in tests. All 12 metadata dependencies and all 8 references remain.
+
+## Validation and operational footprint
+
+Test-first: initial unittest run had 12 tests, with expected failures for missing load points and size reduction (2 failures). Final suite includes unittest classes and the three existing function-style routing tests through `unittest.FunctionTestCase`; plain discovery alone would miss those three. No network required by tests.
+
+Final local validation: `uv run --with pytest python -B -m pytest tests -q` — 16 tests passed. `git diff --check` passed. No remote CI workflow is configured. Publication/installation is separately verified by the parent.
+
+
+## Measured operational footprint
+
+Includes entry and every reference; excludes this audit manifest, tests, adoption record and caches. No removed procedure was moved into an operationally loaded new file.
+
+| File | Before bytes | After bytes | Reduction |
+|---|---:|---:|---:|
+| `SKILL.md` | 27413 | 23017 | 4396 |
+| `references/aerosim-lessons-review.md` | 3400 | 3400 | 0 |
+| `references/common-pitfalls.md` | 2276 | 2276 | 0 |
+| `references/failure-and-documentation.md` | 4428 | 5136 | -708 |
+| `references/planning-artifact-reconciliation.md` | 6624 | 6621 | 3 |
+| `references/repository-entry-and-visibility.md` | 6514 | 6514 | 0 |
+| `references/runtime-and-ci.md` | 11078 | 10654 | 424 |
+| `references/status-and-reporting.md` | 5135 | 5385 | -250 |
+| `references/task-delivery-gates.md` | 17921 | 17921 | 0 |
+| **Total** | **84789** | **80924** | **3865 (4.56%)** |
@@ -1,13 +1,13 @@
 ---
 name: channel-delivery-skic
 description: "Use when operating or synchronizing a Corp v1 project's delivery channel. Drives coding, unit testing, build and continuous-integration health, attempts safe evidence-based fixes, escalates requirement or architecture contradictions, and maintains Ways of Working and Engineering documentation."
-version: 1.14.1
+version: 1.15.0
 author: Hermes Agent
 license: MIT
 metadata:
  hermes:
    tags: [corp-v1, discord, channel, delivery, coding, testing, ci]
-    related_skills: [channel-board-skic, home-v1-discord, documentation-docusaurus, corp-v1-glossary, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-gondor-v1]
+    related_skills: [channel-board-skic, discord, documentation-docusaurus, corp-v1-glossary, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-home-gondor-v1]
 ---

 # SKIC Delivery Channel Reference
@@ -20,27 +20,7 @@ Whenever a response mentions a Hermes Kanban board, initiative, card, or task, i

 ## Canonical Scope Status Vocabulary

-Before reporting or changing any lifecycle status, read the project's current Ways of Working Scope page. Use only the canonical values defined there.
-
-Ideas, Epics, and Features:
-
-```text
-IN_BACKLOG → IN_DESIGN → READY_FOR_DELIVERY → IN_DELIVERY → TO_BE_RELEASED → DONE
-```
-
-Tasks:
-
-```text
-IN_BACKLOG → READY_FOR_DELIVERY → IN_PROGRESS → TO_BE_RELEASED → DONE
-```
-
-`READY_FOR_DELIVERY` is the exact Task's Focus-admitted, pickup-ready state. It means Architecture, dependencies, implementation boundaries, verification steps, and Kanban selection are complete; implementation has not started. Delivery claims that Task by moving it directly to `IN_PROGRESS`. Never require or invent a second Focus-admission decision after `READY_FOR_DELIVERY`.
-
-`CANCELLED` is an exceptional terminal status. `BLOCKED` is a separate flag with a reason and evidence; it never replaces the lifecycle status.
-
-Never invent, abbreviate, or substitute lifecycle values such as `Ready`, `Active`, `Delivered`, `Complete`, `Awaiting CI`, or `Overrun`. Those phrases may describe activity only when clearly separated from the canonical status field. If the canonical status cannot be verified, report `status unverified` and inspect the source record rather than guessing.
-
-A merge or successful CI does not automatically mean `DONE`. Releasable application Tasks normally move from `IN_PROGRESS` to `TO_BE_RELEASED`; `DONE` requires the applicable release or completion evidence. Status reports must show the exact canonical value even when a separate plain-language action is also included.
+Before reporting or changing lifecycle status, load [status-and-reporting.md](references/status-and-reporting.md) and read the project's current Ways of Working Scope page. That contract retains the complete canonical vocabulary, requested wave format and gate codes; `development-integrity` owns checkpoint claims. Delivery claims only an exact `READY_FOR_DELIVERY` Task into `IN_PROGRESS`, without a second Focus admission. `BLOCKED` remains a separate flag; merge/green CI is not `DONE`, and releasable application work normally ends Delivery at `TO_BE_RELEASED`.

 This skill owns delivery health for a Corp v1 project. It monitors the project's `general`, `scope`, `architecture`, `ui-ux`, `kanban`, `delivery`, `uat`, and `releases` channels and implements only tasks whose parent Feature has explicit human `Approved for Implementation` evidence and whose exact Task status is `READY_FOR_DELIVERY`. That status is the Focus-admitted pickup handoff; no separate post-status admission gate exists.

@@ -54,14 +34,7 @@ Load the global `corp-v1-glossary` skill from `https://gitea.lego-cloud.eu/home-

 ## Shared Corp v1 System Login

-When an authorized task requires login to a Corp v1 system being built or operated, follow the shared policy in `channel-board-skic` and use only the Bitwarden-injected runtime secrets named:
-
-```text
-HL_V1_SSO_EMAIL
-HL_V1_SSO_PASSWORD
-```
-
-Secret availability is capability, not authorization. Verify the destination origin and task purpose before login. Never print, inspect, log, hash, serialize, paste, screenshot, or persist either value; never place a value in a command line, URL, file, repository, prompt, Discord message, browser console, test fixture, CI output, or generated artifact. Never ask a human to paste a value into chat. If a variable is unavailable, report only its missing name and request Bitwarden/gateway injection. Login does not authorize account recovery, MFA or credential changes, permission changes, billing, spending, destructive operations, or access outside the approved project task.
+Before login, load `channel-board-skic` from [its authoritative source](https://gitea.lego-cloud.eu/skic-skills/channel-board-skic) and follow **Corp v1 System SSO Credential Use** in full. It owns origin/purpose verification, runtime-only `HL_V1_SSO_EMAIL` / `HL_V1_SSO_PASSWORD` handling, non-disclosure, missing-secret injection and session safety. If that policy cannot be loaded, stop before login. Secret availability is not authorization; Delivery grants no account recovery, credential/MFA, permission, billing, destructive-operation or unrelated-access authority.

 ## When to Use

@@ -90,7 +63,7 @@ This channel skill owns **delivery governance and project-channel coordination**
 | branch naming, worktrees, PR topology, and base synchronization | `development-branching-strategy` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-branching-strategy |
 | pnpm/TypeScript monorepo implementation | `development-monorepo-pnpm` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-monorepo-pnpm |
 | Taskfile, `.scripts/`, shell wrappers, environment validation, and Devbox | `development-scripts` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-scripts |
-| Gondor Argo CD template, rendered desired state, and repository connection | `development-gitops-argo-cd-gondor-v1` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1 |
+| Gondor Argo CD template, rendered desired state, and repository connection | `development-gitops-argo-cd-home-gondor-v1` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1 |

 The channel skill may narrow authority, lifecycle, workspace, visibility, handoff, and evidence requirements. When a project/channel overlay conflicts with a reusable skill on branch naming, human confirmation, worker count, review identity, merge authority, deployment authority, or release authority, the explicit project/channel overlay wins; inherit only the non-conflicting mechanics. It must not restate generic RED–GREEN–REFACTOR mechanics, shell-module layouts, pnpm workspace conventions, ordinary Git branching mechanics, exact-head gate algorithms, or Argo CD authoring procedures. Improve those reusable skills at their linked sources and keep only the project/channel overlay here.

@@ -153,16 +126,7 @@ Delivery still monitors repository-specific compile/type, unit-test, lint/format

 ### Per-project reusable CI base images

-Each Corp v1 project should own `corp-v1-<code>/corp-v1-<code>-base-images` when stable runtimes or operating-system tools would otherwise be downloaded repeatedly in application CI.
-
- Keep one folder per image, with its Dockerfile, machine-readable version/platform metadata, usage documentation, build helper, and static publication contract. Runtime smoke belongs to UAT.
- Pin the upstream base by digest and assert exact runtime/tool versions, architecture, numeric non-root identity, writable workspace, CA trust, Git, shell, and other required tools.
- Build and perform static/unit validation without registry credentials on pull requests. Publish only from the trusted integration branch using a narrowly scoped Harbor robot secret; UAT validates the published digest at runtime.
- Publish immutable full-source-SHA tags, read back the Harbor artifact digest, and consume the image from project workflows by digest—not `latest`, a mutable version tag, or an unverified local name.
- Extend fail-closed tests to reject broad publication triggers, mutable tags, secret access from candidate/PR paths, shell interpolation, wrong digests, and reintroduced runtime setup actions.
- Prefer the verified job image over repeated runtime or package-manager setup actions. Keep lockfile-frozen application dependency installation in the application repository; do not bake project dependencies into a generic base image.
- Treat the first real Gitea build, Harbor publication, digest readback, and consumer workflow at the exact candidate SHA as separate Delivery layers. Runtime smoke is a separate UAT layer.
- Repair image or publication failures forward only. Preserve the last known-good digest for consumers until the replacement image and consuming workflow pass exact-head CI.
+Each project should own `corp-v1-<code>/corp-v1-<code>-base-images` when stable runtimes or OS tools would otherwise be downloaded repeatedly in CI. Before creating, publishing or consuming an image, load [the project base-image bindings and required owner loads](references/runtime-and-ci.md#per-project-reusable-ci-base-images). It retains digest pinning, credential-free candidate validation, trusted integration-branch publication, immutable tags/digest readback, fail-closed tests and forward repair with the last known-good digest. Runtime smoke remains UAT-owned; reusable mechanics are owned by `devsecops-ci-cd-gitea` through that decision-point reference.

 ### Runtime-resource placement

@@ -176,49 +140,11 @@ CI jobs and developer workstations must not provision databases, queues, object

 ## Failure-Repair Workflow

-When a build or CI failure is observed:
-
-1. verify repository, branch, head SHA, failed job, and exact logs;
-2. reproduce locally when feasible;
-3. determine root cause before editing;
-4. compare the intended fix against approved FR/NFRs, ADRs, architecture documentation, and project conventions;
-5. implement the smallest safe fix;
-6. add/update tests where behavior changed;
-7. run local validation;
-8. commit and push through the approved branch workflow;
-9. inspect CI for the exact new head SHA;
-10. report evidence and remaining risk.
-
-The skill may attempt a safe fix when the failure and expected behavior are clear. If evidence is insufficient or requirements/architecture conflict, stop and raise the issue in the relevant channel:
-
- requirement/product ambiguity → `general` and/or `architecture` as appropriate;
- architecture contradiction → `architecture`;
- release policy/readiness ambiguity → `releases`;
- implementation-only blocker → `delivery`.
-
-Never guess the team's intended direction.
+Load [failure-and-documentation.md](references/failure-and-documentation.md#failure-repair-workflow) when a build or CI failure is observed. It owns diagnosis, safe forward repair, affected validation, exact-head CI and escalation destinations. Keep repairable failures in the same Task/gate; pause only for the documented external, authority, decision or safety blocker. Never guess requirements or Architecture, weaken a gate or treat a blocker as passing.

 ## Documentation Ownership

-Maintain two documentation areas.
-
-### Ways of Working — five sections
-
-1. **Delivery workflow** — intake, prioritization, implementation states, and definition of done.
-2. **Branching and reviews** — branch conventions, pull requests, approvals, and merge expectations.
-3. **Planning and ownership** — backlog, sequencing, owners, dependencies, blockers, and escalation.
-4. **Quality practices** — review standards, test strategy, defect handling, and evidence expectations.
-5. **Collaboration and decisions** — channel routing, handoffs, decision references, and communication norms.
-
-### Engineering — five sections
-
-1. **Repository and workspace** — monorepo/application/package structure and local prerequisites.
-2. **Development and unit testing** — commands, unit-test fixtures, debugging, Delivery artifact validation, and the handoff to UAT for every functional non-unit suite.
-3. **Build and continuous integration** — pipelines, checks, artifacts, runners, and failure diagnosis.
-4. **Packaging and deployment preparation** — containers, Helm/GitOps interfaces, configuration, and release inputs.
-5. **Operations and troubleshooting** — observability, known failure modes, recovery checks, and evidence collection.
-
-Update these pages from verified project practice. Do not document a planned process as already operational.
+Delivery owns verified Ways of Working and Engineering content, not documentation-platform mechanics. Before changing either area, load [the domain coverage contract](references/failure-and-documentation.md#documentation-ownership), the linked global `documentation-docusaurus` source and the project-adopted documentation overlay. Load `corp-v1-glossary` before defining reusable terms. Keep planned practice distinct from operational evidence.

 ## UI/UX Coordination

@@ -289,17 +215,7 @@ When selectable controls are needed, explain every complete option and its trade

 ## Common Pitfalls

-1. Patching symptoms before understanding root cause.
-2. Changing requirements or architecture implicitly through code.
-3. Claiming CI success from a local build.
-4. Editing without loading applicable project engineering skills.
-5. Skipping tests for behavioral fixes.
-6. Updating documentation with aspirational rather than actual practice.
-7. Repeatedly posting unchanged failure summaries.
-8. Inspecting another project.
-9. Starting implementation because requirements exist but human implementation approval is absent.
-10. Ignoring architecture task dependencies, Kanban Focus admission, or target-version allocation.
-11. Posting passive status when safe implementation, testing, diagnosis, or documentation work is available.
+Load [common-pitfalls.md](references/common-pitfalls.md) on failed gates, resumed work and before blocker/CI/merge/completion reports. It retains the complete Delivery traps, including approval/admission, same-project scope, useful safe activity, real evidence and same-gate forward repair. These reminders do not replace the ordered Task gates.

 ## Verification Checklist

@@ -0,0 +1,30 @@
+# Naming Delivery review
+
+## Outcome
+
+Applied the seven requested canonical skill-identity bindings only inside the two assigned Delivery source packages. Operational entry/reference loads and routing tests use canonical names. AeroSim retains exactly **18 direct dependencies**; central Delivery retains its original **12**. Compatibility aliases are not added as owners. Completed responsibility consolidation and all retained gate, recovery, worker, storage, UAT and authority clauses remain intact.
+
+## Preservation and evidence
+
+- Original checksum manifests were not edited or regenerated. Golden comparisons reverse only the explicit seven identity substitutions before matching protected clauses/checksums; original hashes remain authoritative.
+- Added exact dependency-list/count/uniqueness tests against Git HEAD, reversible mapping tests, negative policy-mutation checks, and operational legacy-load detection. Generic Discord tags, runtime workspace/environment names and provenance URLs are not normalized.
+- Historical SIMPLIFICATION/ADOPTION records and legacy source URLs remain unchanged as provenance. Canonical repository publication is the parent's work; this local review does not invent new repository URLs or claim publication of those pending owner packages.
+- FULL-PROGRAM.md now cites Piotras Board approval plainly at message `1563064779772526616`. Its acceptance update records parent-reported GitOps canonical+alias+generic-base install/skill_view verification at `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`, plus merged/installed gates `02e716ddff053c71a921839419ed2bd2334f1e67`, integrity `3ca0fbb284b5eb194ad5ff1f2756f1fde0077c6a`, TTD `d3d91be7bb2926b0f1bd16db60c0fe2250ed8d39` and wave `a180018ef3bc337bb1fbabd095fa7a4e13471fc5`.
+- `corp-v1-glossary` identity/source unchanged: public-to-private transfer needs a decision. **A02/A04 remain unresolved and require a human choice.** A17 bounded resumption-evidence gap remains unchanged.
+
+## Executed local verification
+
+Using `/opt/hermes/.venv/bin/python` with each package's standalone `verify_full_program.py`:
+
+| Package | unittest | standalone functions/main | total | local links | diff check |
+|---|---:|---:|---:|---:|---|
+| channel-delivery-skic | 22 | 3 | 25 | 29 | passed |
+| channel-delivery-skic-aerosim | 32 | 4 | 36 | 36 | passed |
+
+Central operational content: 80,924 HEAD baseline → 76,535 bytes; AeroSim: 105,884 → 104,686 bytes. These retain consolidation reductions despite longer canonical names.
+
+## Changed files / limits
+
+Both packages: SKILL.md, FULL-PROGRAM.md, runtime-and-ci.md, affected routing/semantic tests, golden-comparison tests and standalone verifier import setup. AeroSim additionally: planning-artifact-reconciliation.md, failure-and-documentation.md and gitea-actions-policy.md. Added `canonical_identity.py` and `test_canonical_identity.py` under each existing harness directory, and this review report.
+
+Existing worktree modifications were preserved. No commit, push, install, scheduler/account operation or runtime write occurred. No owner publication performed here. Initial local mapping regex was corrected before verification; all final standalone harness checks pass. No unresolved local test failures.
@@ -2,25 +2,20 @@

 Load this reference when a gate fails, when work resumes after interruption, or before reporting a blocker, CI result, merge, or completion.

+Before execution, load [runtime-and-ci.md](runtime-and-ci.md#execution-context-toolchain-preflight) for exact-context preflight. Before claims, load `development-gates` and `development-integrity`, then [status-and-reporting.md](status-and-reporting.md) and [planning-artifact-reconciliation.md](planning-artifact-reconciliation.md) for project formatting, semantic reconciliation and duplicate suppression.
+
 ## Common Pitfalls

 1. Patching symptoms before understanding root cause.
 2. Changing requirements or architecture implicitly through code.
-3. Claiming CI success from a local build.
-4. Editing without loading applicable project engineering skills.
-5. Skipping tests for behavioral fixes.
-6. Updating documentation with aspirational rather than actual practice.
-7. Repeatedly posting unchanged failure summaries.
-8. Inspecting another project.
-9. Starting implementation because requirements exist but human implementation approval is absent.
-10. Ignoring architecture task dependencies, the Task's `READY_FOR_DELIVERY` handoff, or target-version allocation.
-11. Posting passive status when safe implementation, testing, diagnosis, or documentation work is available.
-12. Treating a human-merged planning or Architecture documentation PR as implementation approval.
-13. Treating an ideation-board entry, generated presentation, or broad approval as equivalent to an exact Task `READY_FOR_DELIVERY` transition—or requiring a second admission after that verified transition.
-14. Validating a stale channel-reported SHA instead of freshly resolving and checking the current remote merge head.
-15. Continuing to report or validate an open PR head after the PR merged during the run; re-resolve the merge/default-branch SHA and require local validation plus CI for that exact merge commit.
-16. Reposting an unchanged gate summary when no new decision, head, CI result, failure, or durable artifact exists.
-17. Editing in a local-only worktree or on a differently named local branch before the exact remote branch and PR head are visible and verified.
-18. Starting `pnpm`, tests, or a background worker before checking the toolchain and required environment inside that exact execution context.
-19. Reporting only “failed” or leading with hashes instead of the linked branch/PR and the exact failed command, file, test, or CI job.
-20. Stopping at a repairable gate failure, abandoning the active Task, or starting another Task instead of fixing forward and rerunning the gate until it passes.
+3. Editing without loading applicable project engineering skills.
+4. Skipping tests for behavioral fixes.
+5. Updating documentation with aspirational rather than actual practice.
+6. Inspecting another project.
+7. Starting implementation because requirements exist but human implementation approval is absent.
+8. Ignoring architecture task dependencies, the Task's `READY_FOR_DELIVERY` handoff, or target-version allocation.
+9. Posting passive status when safe implementation, testing, diagnosis, or documentation work is available.
+10. Treating a human-merged planning or Architecture documentation PR as implementation approval.
+11. Treating an ideation-board entry, generated presentation, or broad approval as equivalent to an exact Task `READY_FOR_DELIVERY` transition—or requiring a second admission after that verified transition.
+12. Editing in a local-only worktree or on a differently named local branch before the exact remote branch and PR head are visible and verified.
+13. Stopping at a repairable gate failure, abandoning the active Task, or starting another Task instead of fixing forward and rerunning the gate until it passes.
@@ -10,8 +10,8 @@ When a build or CI failure is observed:
 2. reproduce locally when feasible;
 3. determine root cause before editing;
 4. compare the intended fix against approved FR/NFRs, ADRs, architecture documentation, and project conventions;
-5. implement the smallest safe fix;
-6. add/update tests where behavior changed;
+5. load `development-method-ttd` and [runtime-and-ci.md — Unit testing](runtime-and-ci.md#unit-testing); observe the product-reason unit failure before behavior changes;
+6. implement the smallest safe forward fix, preserving valid shared work and missing-RED honesty;
 7. run local validation;
 8. commit and push through the approved branch workflow;
 9. inspect CI for the exact new head SHA;
@@ -29,7 +29,9 @@ Never guess the team's intended direction, weaken a gate, or treat a blocker as

 ## Documentation Ownership

-Maintain two documentation areas.
+Before authoring or validating documentation, load `documentation-docusaurus` from [the global source](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus) and the project-adopted documentation overlay for Diátaxis, Markdown/MDX, navigation and build mechanics. Verify source identity: an unrelated same-name installation is not this global owner. Before defining reusable terms, load `corp-v1-glossary` from [its source](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/corp-v1-glossary); it owns canonical definitions in the final top-level Glossary and domain-page links. If the required owner cannot be loaded, stop the affected documentation action.
+
+Delivery retains these domain outcomes in two areas:

 ### Ways of Working — five sections

@@ -51,14 +53,4 @@ Update these pages from verified project practice. Do not document a planned pro

 ## Synchronization Workflow

-When planning documentation, Architecture structure, or Kanban state changes while implementation remains gated, follow [`planning-artifact-reconciliation.md`](planning-artifact-reconciliation.md). It defines fresh remote-head discovery, exact-merge-SHA validation, `READY_FOR_DELIVERY` handoff interpretation, evidence boundaries, and duplicate-status suppression.
-
-1. Read new same-project activity and enough delivery history to avoid duplicates.
-2. Before claiming new task work, verify exact-item `Approved for Implementation` evidence, exact Task `READY_FOR_DELIVERY` state, task dependencies, approved UI/UX handoff when applicable, and target version.
-3. Identify executable tasks, CI failures, blockers, requirements/ADR implications, and documentation drift.
-4. Load all applicable project engineering skills.
-5. Complete at least one useful safe activity when an authorized path exists; otherwise document and route the exact blocker.
-6. Escalate uncertainty or contradiction rather than selecting direction.
-7. Verify local and remote results and update task/Feature progress in project documentation.
-8. Maintain Ways of Working and Engineering pages when durable practice changed.
-9. Post a concise update with work completed, evidence, blockers, and required decisions.
+Before reconciling planning/Architecture/Kanban changes, load [planning-artifact-reconciliation.md](planning-artifact-reconciliation.md) for Task-row semantics and its verification-owner loads. Use the entry skill's synchronization/iteration contract for useful safe work and current documentation. Reconcile only changed evidence; do not duplicate its workflow here.
@@ -1,27 +1,27 @@
 # Planning-artifact reconciliation

-Use this procedure when Scope, Architecture, Kanban, Ways of Working, Engineering, or release-readiness documentation changes while Feature implementation remains gated.
+Use when planning or readiness documentation changes while implementation remains gated.

-## Procedure
+## Verification owners — load at the decision point

-1. Read the latest same-project channel activity and identify human actions separately from Hermes-authored status reports.
-2. Re-fetch the documentation repository and resolve the current remote default/test head. Do not reuse a SHA from an earlier channel report.
-3. Read back relevant pull requests and distinguish `open`, `closed`, and `merged`; a human merge is evidence that documentation landed, not evidence that a Feature changed lifecycle state.
-4. Resolve the current source ref and full head SHA from the fresh PR API response before fetching. Do not infer the branch name from a PR title, an older checkout, a prior report, or a similarly named local branch. Fetch that exact `head.ref` into an unambiguous temporary remote-tracking ref, create a clean detached worktree from it, and assert `git rev-parse HEAD` equals the API-reported full SHA before validation.
-5. Validate the exact head in that clean or detached worktree using the repository's own validation command. Explicitly execute package-manager commands with the worktree as the process working directory (or begin the shell block with `cd "$worktree"`); setting up the worktree in an earlier command does not make it the current directory for a later process. Install dependencies with the repository's declared frozen-lockfile command when the clean worktree has no installed dependencies. If the package manager shim is unavailable, use the repository-declared package-manager launcher rather than changing project files. Before running a composite package script, verify that child scripts can resolve the package-manager executable too: `corepack pnpm validate` can start successfully yet fail when `validate` invokes nested `pnpm ...` commands. In that case, create a writable temporary shim directory with `corepack enable --install-directory <cache>/pnpm-bin`, prepend it to `PATH`, and run the declared command (for example, `PATH=<cache>/pnpm-bin:$PATH pnpm validate`). Keep the shim and dependency cache outside committed content, run `git diff --check`, and confirm the worktree remains clean afterward.
-6. Query Gitea Actions tasks and match the full exact head SHA. Require each matching task to report `success`; do not transfer a PR-head result to the eventual merge head. Keep Gitea identifiers distinct: the Actions task API `id`, its `run_number`, and any UI run URL/ID are separate fields and may not have the same value. Report the exact field actually returned by the verified endpoint (for example, `task id 684, run_number 66`) rather than relabeling a channel-reported UI run ID as a task ID.
-7. Read back the changed planning artifacts through the authenticated raw-file API at the exact PR source ref and verify their **semantics**, not merely keyword presence. Headings and lifecycle guidance naturally contain terms such as `READY_FOR_DELIVERY`, so keyword presence alone does not prove a Task is pickup-ready. For Kanban, assert the exact Task row and status, the evidence timestamp, and any newly cited head/task pairs; also assert superseded pairs are absent when the change claims reconciliation. Parse each lifecycle section independently and verify the Task's actual row rather than using loose whole-file heuristics such as a state-name count. If an automated semantic probe disagrees with the rendered Markdown, read the relevant numbered lines and correct the probe before reporting.
-8. Immediately before reporting, re-fetch the PR, its remote source ref, the default branch, and exact-SHA tasks. Scheduled writers or human reviewers can change repository state during local validation.
-   - If the open PR source head advanced, treat the completed source-head check as stale and validate the new source head.
-   - If the PR merged or closed during validation, stop describing it as open. Fetch the freshly resolved merge/default-branch SHA, create or switch to a clean detached worktree at that exact commit, rerun the repository's declared validation and semantic probes there, and require a successful Actions task whose full `head_sha` equals the merge commit. PR-head CI must not be transferred to the merge head.
-   - Re-fetch once more after merge-head validation and assert the PR state, default-branch SHA, local validated SHA, and latest exact-SHA terminal task still agree. If another Delivery report already covers that identical evidence, remain silent.
-9. Reconcile Kanban separately:
-   - Proposed Epics/Features may appear in an ideation view.
-   - An exact Task is Focus-admitted and pickup-ready when its status is `READY_FOR_DELIVERY`; there is no second Focus-admission gate.
-   - A newly added Kanban page or merged board does not itself move an exact Task to `READY_FOR_DELIVERY`.
-10. Re-evaluate every implementation gate from the source files and approvals: Approved for Implementation, FR/NFR and ADR context, task/dependency plan, target version, acceptance evidence, and exact Task `READY_FOR_DELIVERY` state.
-11. If the gate remains closed, do not create application changes. A useful delivery activity can be exact-head build/CI verification, durable documentation reconciliation, or a newly evidenced blocker report.
-12. Report only deltas not already covered by the latest delivery message. Include repository, branch, full SHA, local commands/results, exact-SHA task IDs, and the specific missing gate.
+Before verifying a PR or CI, run `skill_view(name="development-gates")` and load its `references/review-ci-merge-contract.md`: **Evidence model**, **Attempt integrity**, and **Concurrent publication** own candidate/remote equality, complete successful job inventory including aggregates, and separate integration evidence. Do not use a successful listed-task subset as a gate.
+
+Before reporting, load `skill_view(name="development-integrity")` and its `references/remote-checkpoint-matrix.md` for the current remote checkpoint, changed-head invalidation and candidate-versus-integration claims; then load [status-and-reporting.md](status-and-reporting.md) for Delivery formatting. Preserve project reviewer/merge authority; A02/A04 review-order/base-drift remain bounded unresolved clauses, not implicitly settled by these loads.
+
+Before validation, load `documentation-docusaurus` and the project-adopted overlay through [Documentation Ownership](failure-and-documentation.md#documentation-ownership); verify source identity. Run the complete repository validator and production build with frozen-lockfile installation and `git diff --check`. The global owner identity mismatch remains unresolved: retain the bounded nested-pnpm fallback below, not an assumed replacement owner.
+
+If child scripts cannot find pnpm, use `corepack enable --install-directory <cache>/pnpm-bin`, prepend that temporary shim directory to `PATH`, and rerun the declared command. Keep shim/dependency caches outside commits and verify the worktree remains clean.
+
+## Retained validation bindings
+
+- Use the fresh PR API `head.ref` and full SHA, never a title or old report, for a clean detached worktree inside the Task boundary. Assert its actual HEAD and process working directory before repository-native validation. These exact-worktree checks remain local until the installed owner carries them.
+- If the PR merged or closed during validation, update its reported state and validate the freshly resolved merge/default head, including semantic probes. Use the owners above for fresh evidence immediately before reporting; repeat if it changes. Keep API task `id`, `run_number`, run/attempt/job IDs and UI URLs distinct in retained evidence.
+
+## Delivery interpretation
+
+Read current same-project activity and distinguish human decisions from agent reports. Verify changed artifacts by authenticated readback at the validated revision and inspect their **semantics**: the exact Task row and status, evidence timestamp, new head/task pairs and absence of superseded pairs when reconciliation claims their removal. Parse lifecycle sections separately; headings, keyword counts and generated presentations are not Task-state evidence. If a probe disagrees with rendered Markdown, inspect numbered lines and correct the probe before reporting.
+
+New pickup requires current `READY_FOR_DELIVERY`, dependencies, target version, parent Feature implementation approval and FR/NFR/ADR/UI/UX readiness under the preserved project authority. That status already records admission: no second Focus-admission decision. Continuation instead requires current `IN_PROGRESS`, its existing claim and historical verified admission; do not demand re-admission or mistake historical portfolio status for current Task authority. A merged Board page does not itself admit a Task. If the gate remains closed, do not create application changes; verify or reconcile documentation or route the evidenced blocker instead.

 ## Evidence interpretation

@@ -34,80 +34,51 @@ Resolve the channel root as `<code>-delivery/` under the active user's working r

 ## Shared Corp v1 System Login

-When an authorized task requires login to a Corp v1 system being built or operated, follow the shared policy in `channel-board-skic` and use only the Bitwarden-injected runtime secrets named:
-
-```text
-HL_V1_SSO_EMAIL
-HL_V1_SSO_PASSWORD
-```
-
-Secret availability is capability, not authorization. Verify the destination origin and task purpose before login. Never print, inspect, log, hash, serialize, paste, screenshot, or persist either value; never place a value in a command line, URL, file, repository, prompt, Discord message, browser console, test fixture, CI output, or generated artifact. Never ask a human to paste a value into chat. If a variable is unavailable, report only its missing name and request Bitwarden/gateway injection. Login does not authorize account recovery, MFA or credential changes, permission changes, billing, spending, destructive operations, or access outside the approved project task.
-
+Before login, load `channel-board-skic` and follow its complete **Corp v1 System SSO Credential Use** policy through [Delivery's source/authority binding](../SKILL.md#shared-corp-v1-system-login). Stop if unavailable; secret access grants no additional authority.

 ## Delivery Responsibilities

 ### Coding

- implement only human-approved Features and their authorized tasks;
- load applicable project engineering skills before changing code;
- preserve project structure, conventions, and environment namespace;
- keep changes small, reviewable, and traceable to requirements/issues;
- avoid unrelated refactors during failure repair;
- never fabricate command, test, CI, or deployment results.
+Load `development-monorepo-pnpm` for pnpm/TypeScript implementation and `development-scripts` for Taskfile, shell, environment and Devbox work, using their [source links and project-overlay precedence](../SKILL.md#development-skill-routing). Preserve project structure/namespace; implement only approved Features and authorized Tasks with small, traceable changes, no unrelated refactors and no fabricated results.

 ### Unit testing

- add or update tests with behavioral changes;
- reproduce defects before fixing when practical;
- cover normal, edge, and failure cases proportional to risk;
- run the narrowest relevant tests first, then required broader validation;
- record exact commands and real results.
+Load `development-method-ttd` before every behavior change, defect fix or refactor. Follow its mandatory failing-test-first unit workflow and retain real commands/results; request non-unit coverage from UAT. Exceptions require the authorized project owner explicitly approving a documented exception. Discard/start-over applies only to the executor's isolated, unpublished experimental delta, preserving unrelated or valid work. Never rewrite shared history, delete another worker's changes or revert integrated work. Repair shared/integrated code forward, record historical missing RED honestly and never claim retrospective tests proved test-first compliance; seek the named project-authority exception if compliant repair cannot satisfy the gate.

 ### Build and continuous integration

-Monitor local builds and Gitea Actions for:
-
- compile/type failures;
- unit-test failures and UAT-reported non-unit failures;
- lint/format failures;
- dependency, packaging, container, or chart failures;
- workflow/configuration defects;
- missing or stale artifacts;
- branch/head-SHA mismatch.
-
-A green local build is not proof that CI or delivery succeeded. Verify the actual remote branch and matching CI task/run.
+Use [Delivery's build/CI responsibilities](../SKILL.md#build-and-continuous-integration) for the required failure classes and UAT remediation boundary. Before reporting CI, load `development-integrity` through [status-and-reporting.md](status-and-reporting.md); a local build is not remote CI evidence. Task gate job inventory and exact-head checks still apply.

 ### Execution-context toolchain preflight

-Treat every foreground shell, detached worktree, background process, Hermes main-session review command, and CI job as a separate execution context. Before any repository command or operation runs in an execution context, complete the applicable preflight for that exact context. For a Node/pnpm repository—or any command that may invoke Node or pnpm—the following checks are mandatory:
+Immediately before every repository operation, load `skill_view(name="development-scripts", file_path="references/runtime-preflight.md")` for exact-context checks and repair, plus `skill_view(name="development-monorepo-pnpm", file_path="references/workspace-and-tooling.md")` for committed versions. Load `development-scripts` for the selected repository's script overlay; generic mechanics never replace project authority.

-1. resolve the repository-required Node and pnpm versions from its committed toolchain contract;
-2. run `command -v node`, `node --version`, `command -v pnpm`, and `pnpm --version` inside the exact context, then compare the observed versions with the committed required versions;
-3. verify required non-secret environment variable names are present, including disposable-test database markers when applicable, without reading or printing their values;
-4. verify the actual working directory, linked branch/PR identity, and clean or intentionally staged repository state; and
-5. start the repository command only after every applicable preflight check passes.
+Treat every foreground shell, detached worktree, background process, worker, Hermes main-session review command, and CI job as a separate execution context. Complete the applicable preflight in that exact context before execution; the full owner procedure is mandatory for a Node/pnpm repository or any command that may invoke Node or pnpm. Stop on failed preflight or an unavailable owner; do not run the original command until its complete preflight passes.

-Never assume a background process inherits `PATH`, shell activation, Devbox state, Corepack activation, database variables, or other exports from a foreground terminal. A missing `pnpm` executable is always an execution-context/toolchain failure, never an application-code or test failure. Repair the exact context by providing the required toolchain path or activation, repeat the complete preflight there, and rerun the original command before making any claim about repository code.
+Delivery supplies the selected Task directory, selected repository, expected branch/PR/revision, required non-secret environment names under `CORP_V1_<CODE>_*`, and allowed command scope. Preserve Task/cache isolation and real-CWD containment above. Preflight does not authorize resource-dependent tests, functional non-unit suites, credentials, Devbox execution or deployment; the existing project boundary decides allowed operations. Narrow local checks never replace complete repository CI, all required jobs/aggregates or exact-head evidence in [Task gates](task-delivery-gates.md).
+
+Before Delivery publication/install or operational adoption, verify the published and installed owner reference covers the mapped safeguards and record its immutable owner revision and reference hash. The adopted immutable owner revisions and reference hashes are recorded in FULL-PROGRAM.md and the owner-consolidation manifest; a sibling source checkout is not installed-owner evidence. If that gate is unresolved, stop adoption rather than silently weakening preflight. See [FULL-PROGRAM.md](../FULL-PROGRAM.md#final-bounded-owner-consolidation) for inspected evidence.

 ### Per-project reusable CI base images

 the adopted project owns `corp-v1-<code>/corp-v1-<code>-base-images` as the reusable CI-image repository. Use it when stable runtimes or operating-system tools would otherwise be downloaded repeatedly in application jobs.

- Keep one folder per image, with its Dockerfile, machine-readable version/platform metadata, usage documentation, build helper, and static publication contract. Runtime smoke belongs to UAT.
- Pin the upstream base by digest and assert exact runtime/tool versions, architecture, numeric non-root identity, writable workspace, CA trust, Git, shell, and other required tools.
- Build and perform static/unit validation without registry credentials on pull requests. Publish only from the trusted `test` branch using a narrowly scoped Harbor robot secret; UAT validates the published digest at runtime.
- Publish immutable full-source-SHA tags, read back the Harbor artifact digest, and consume the image from the adopted project workflows by digest—not `latest`, a mutable version tag, or an unverified local name.
- Extend fail-closed tests to reject broad publication triggers, mutable tags, secret access from PR paths, shell interpolation, wrong digests, and reintroduced runtime setup actions.
- Prefer the verified job image over repeated `actions/setup-node` or package-manager bootstrap steps. Keep `pnpm install --frozen-lockfile --ignore-scripts` in the application repository for lockfile parity; do not bake project dependencies into a generic base image.
- Treat the first real Gitea build, Harbor publication, digest readback, and consumer workflow at the exact PR-head SHA as separate Delivery layers. Runtime smoke is a separate UAT layer.
- Repair image or publication failures forward only. Preserve the last known-good digest for consumers until the replacement image and consuming workflow pass exact-head CI.
+Before creating, validating, publishing, consuming or repairing a base image, load `skill_view(name="devsecops-ci-cd-gitea", file_path="references/base-images.md")`, then its `references/pipeline-workflow.md` and `references/harbor-auth.md` trust/credential contracts. The owner carries construction, credential-free candidate validation, immutable publication/readback, fail-closed regressions and consumer verification mechanics. Stop if unavailable; retain all project-specific image requirements rather than replacing them with generic defaults.
+
+- Publish only from the trusted `test` branch of the selected project base-image repository; candidate checks remain credential-free. The global owner's configurable branch does not change this binding.
+- Consume the directly verified immutable digest in project workflows, never `latest`, a mutable tag or an unverified local name. Keep the first real Gitea build, Harbor publication, digest readback and consumer workflow at the exact PR-head SHA as separate Delivery evidence layers.
+- Runtime smoke and published-digest runtime acceptance belong to UAT, separately from Delivery static/unit validation. No publication or consumer success implies deployment or UAT acceptance.
+- Repair image or publication failures forward only. Preserve the last known-good digest for consumers until the replacement image and consuming workflow pass exact-head CI and applicable UAT acceptance.
+
+Owner adoption evidence: global CI source `669e28eadfe79ac7cb3c10ccdea318dd5296d481`; inspected source and installed `references/base-images.md` are byte-identical (SHA-256 `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`). Its `owner-responsibility.json` maps both Delivery contracts. Reverify the complete published owner package and project CI overlay at adoption; this is owner-policy evidence, not a consumer build, publication or runtime result.

 ### Gondor runtime-resource placement

-The adopted project CI jobs and developer workstations must not provision PostgreSQL, queues, object stores, caches, brokers, or other application runtime services. Load `development-gitops-argo-cd-gondor-v1` before defining or changing Gondor desired state. Render the committed project template separately into one repository per environment; Delivery may update only the repository assigned to its non-production environment, while production remains outside Delivery authority unless an explicit project overlay says otherwise.
+The adopted project CI jobs and developer workstations must not provision PostgreSQL, queues, object stores, caches, brokers, or other application runtime services. Load `development-gitops-argo-cd-home-gondor-v1` before defining or changing Gondor desired state. Render the committed project template separately into one repository per environment; Delivery may update only the repository assigned to its non-production environment, while production remains outside Delivery authority unless an explicit project overlay says otherwise.

 - Keep every non-production the adopted project environment—including development, integration, test, staging, and preview—and all of its resources isolated from production and from other non-production environments. Destructive or concurrent validation requires a per-run database/schema/role or explicit serialization; it must not reset shared data.
 - Delivery CI may orchestrate exact-head unit/build validation, but it must not start application runtime-resource service containers or receive application-resource credentials. Harmless process-local unit-test doubles and build tools are not runtime resources. UAT owns resource-dependent tests and their restricted execution; Delivery only provisions an approved development dependency and hands its exact identity to UAT. Do not expose PostgreSQL or another internal resource through Ingress, NodePort, LoadBalancer, or a runner-accessible public endpoint.
- Persistent Gondor storage must follow `home-v1--truenas`. For durable the adopted project data, create a purpose-specific TrueNAS dataset and NFS share restricted to Gondor node networks, then bind a static PV/PVC with `persistentVolumeReclaimPolicy: Retain` and `storageClassName: ""`. Do not use the default dynamic `truenas-csi` StorageClass for durable data because its `Delete` reclaim policy can remove the backing dataset with the PVC.
+- Before storage design or mutation, load `truenas` and `references/gondor-retained-application-storage.md`. That owner supplies dataset/NFS, retained static PV/PVC and live StorageClass verification; stop if unavailable. Durable storage must not use a deletion-reclaim policy. The load grants no platform authority and does not assert current live storage state.
 - Use only External Secrets backed by the existing Bitwarden `ClusterSecretStore`; never commit connection strings or credentials.
 - Provision and verify required Gondor resources before deploying dependent the adopted project code. Resource-independent implementation may proceed, but deployment remains blocked until the dependency is healthy and consumed by the application.
@@ -1,6 +1,6 @@
 # the adopted project Status and Reporting

-Load this reference when reading Task states or reporting Task, wave, CI, blocker, or completion status.
+Before reporting, load [development-integrity](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity) for checkpoint claims and implementation-versus-closure evidence. Delivery retains the vocabulary/format below and its existing review, gate, repair/help and scheduler boundaries; this load resolves none of those policy questions.

 ## Scope Status Vocabulary

@@ -1,6 +1,11 @@
 # the adopted project Task Delivery Gates

-This file contains the complete ordered procedure for delivering one the adopted project Task. Load it before selecting or continuing a Task.
+This file contains the ordered Delivery overlay for delivering one the adopted project Task. Load it before selecting or continuing a Task.
+
+
+Before candidate review, CI, merge or integration verification, run `skill_view(name="development-gates")` and load `references/review-ci-merge-contract.md`. Its Evidence model and Attempt integrity own immutable identities, complete required job/aggregate inventory, one successful attempt and separate integration evidence. Use those mechanics at each stage; retain the local exit outcomes and reviewer/authority bindings below. Missing owner guidance blocks the affected gate.
+
+**Bounded unresolved A02/A04:** substantive push/review order and “base drift is harmless” remain recorded local clauses pending the separate exact resolution. This consolidation does not choose between them and the reusable owner's ordering/base rule. Do not treat the load as approval of a new exception; route an affected conflict before acting.

 ## End-to-End Task Delivery Gates

@@ -10,7 +15,7 @@ These gates are mandatory and ordered. Each `GATE_###_NAME` code is the stable i
 - Task files and project documentation: `corp-v1-<code>/corp-v1-<code>-documentation`; and
 - this Delivery skill: `corp-v1-<code>-skills-code-agent/channel-delivery-skic-<code>`.

-All local work and evidence for a Task is isolated under `<code>-delivery/workspace/<TASK_ID>/`. Start with the required repository clones. Create Task-local `review/`, `cache/`, `tmp/`, `logs/`, or `artifacts/` only when a concrete activity for that Task needs them. Reusable installed toolchains and technical dependencies belong in `<code>-delivery/cache/` so later Tasks can reuse verified versions. Channel-provided input files belong in `<code>-delivery/uploads/`.
+Before repository entry, load [repository-entry-and-visibility.md](repository-entry-and-visibility.md) for the complete entry/branch/visibility contract and [runtime-and-ci.md](runtime-and-ci.md#channel-owned-workspace) for required clones, optional directories, reusable cache and Task isolation. These remain mandatory gate inputs, not optional background reading.

 Hermes main session owns the Task, performs implementation and exact-head review, and communicates with the active project authority. Local repository tools execute deterministic commands. Gitea Actions runs remote CI. Gondor/GitOps is used only by an approved deployment or Release process. Cron never owns or continues a Task. No implementation or review subagent may work on the selected Task.

@@ -18,19 +23,17 @@ Verification is part of each stage, not a separate end checklist. Before leaving

 ### Mandatory gate-failure recovery

-If any check, command, test, review, CI job, merge precondition, integration check, publication check, or Exit gate fails, the Task remains in that same gate. Hermes must diagnose the root cause, implement the smallest safe forward fix within the approved Task scope, rerun every affected check, and repeat this repair-and-verification loop until the complete gate passes. A repairable failure is work to fix; it is not a stopping point, a reason to abandon the Task, or permission to start another Task.
-
-Hermes may pause the repair loop only when progress requires an unavailable external dependency or credential, a human decision or permission, a change outside the approved requirements or Architecture, or an unsafe, destructive, or otherwise unauthorized action. In that case, keep the Task's lifecycle status unchanged, record `BLOCKED` separately with the exact evidence, responsible owner, and next action, and resume the same gate as soon as the blocker is removed. Never bypass, weaken, suppress, or relabel a failed gate to make it pass.
+Before repairing any failed check/review/CI/publication/exit condition, load [Failure-Repair Workflow](failure-and-documentation.md#failure-repair-workflow). It owns diagnosis, scope-safe forward repair, affected revalidation, blocker evidence and routing. Remain in the same gate until its complete exit passes; never weaken or relabel a failed gate. Pause only for its external-dependency, credential, decision, authority or safety blocker, recording `BLOCKED` separately without changing lifecycle status. Resume the same gate when removed.

 ### Stage 1 — `GATE_001_PREP` — Pick, Start, and Open the Task PR

-**Repository and branch:** First read `corp-v1-<code>/corp-v1-<code>-documentation` remote `test` without creating a branch. After one eligible Task is identified, create `<code>-delivery/workspace/<TASK_ID>/`. Create only its initial fresh repository clones: clone the application repository into `application/` and documentation repository into `documentation/`. Do not create optional support folders during preparation. In `application/`, create branch `<release>/<TASK_ID>-<short-explanation>-<attempt>` from application `test`, with a PR whose title exactly equals the branch name and whose base is `test`. In `documentation/`, create branch `<release>/<TASK_ID>-start-delivery-<attempt>` into documentation `test`, with the same title/base rules.
+**Repository and branch:** Read documentation remote `test` before branching. Establish fresh `application/` and `documentation/` clones inside the selected Task workspace under the loaded entry contract. Application branch: `<release>/<TASK_ID>-<short-explanation>-<attempt>`; documentation claim branch: `<release>/<TASK_ID>-start-delivery-<attempt>`. Each PR title equals its branch and targets `test`.

 **Runtime:** Hermes main session verifies eligibility, creates and reads back the application branch and PR without editing repository content, then creates the documentation branch and PR, updates the Task file, runs documentation checks, and merges the documentation PR only after its checks pass. Gitea Actions runs remote checks. Do not use HermesSubAgent or cron.

-**Required work:** Verify that the Task file says `READY_FOR_DELIVERY`, the Board places the Task in the current wave, dependencies have reached the states required by the Task, the parent Feature has implementation approval, and required Architecture, requirements, target release, and UI/UX inputs exist. Inspect only the adopted project's eight project channels and select exactly one Task. Create the Task workspace and fresh application/documentation clones before repository mutation. Fetch application `test`; create the exact local application branch; use an empty kickoff commit if Gitea requires a difference; push; open the application PR; and verify that local branch, remote branch, PR head branch, local head, remote head, PR title, and `test` base match. Then use the Task's documentation clone to add the hash-linked `READY_FOR_DELIVERY` to `IN_PROGRESS` event with actor, time, Task, wave, application branch/PR evidence, previous hash, and new hash, and merge that documentation change.
+**Required work:** Apply the loaded entry contract to exactly one current-wave `READY_FOR_DELIVERY` Task: Feature approval, dependencies, Architecture/requirements, target release and UI/UX readiness. Inspect only the adopted project’s eight channels. Establish and read back the application branch/PR before any edit. In the Task’s documentation clone add the hash-linked `READY_FOR_DELIVERY` to `IN_PROGRESS` event with actor, time, Task, wave, branch/PR evidence, previous hash and new hash; validate/review/merge it.

-**Exit gate:** The Task directory exists under `<code>-delivery/workspace/<TASK_ID>/`; its required `application/` and `documentation/` clones exist and have the expected remotes; no optional support folder was created without a concrete Task need; no Task checkout was created elsewhere; the application branch and PR are visible and all identities match; the documentation PR is merged; and the Task file on remote documentation `test` says `IN_PROGRESS`. Only then may source, test, configuration, or application documentation files be edited. Report the selected Task, wave, satisfied dependencies, application PR, Task workspace, and merged status change. If eligibility evidence is missing or contradictory, do not select or mutate the Task and do not create the application branch; stop and name the responsible owner.
+**Exit gate:** Loaded workspace and entry checks pass: required Task-local clones have expected remotes, optional folders have a concrete need, and application branch/PR identity is verified. Documentation claim is merged and remote Task state is `IN_PROGRESS`. Only then edit repository content. Report Task, wave, dependencies, PR, workspace and merged claim. Missing or contradictory eligibility blocks selection, mutation and branch creation; name the owner.

 ### Stage 2 — `GATE_002_TASK_PLAN` — Plan the Task

@@ -46,18 +49,18 @@ Hermes may pause the repair loop only when progress requires an unavailable exte

 **Repository and branch:** Use `<code>-delivery/workspace/<TASK_ID>/application/` on the existing application Task branch and PR. Application source, unit tests, configuration, application-documentation changes, builds, and image/container/Helm artifact validation stay in that clone and branch. Every functional non-unit suite stays in the UAT-owned E2E repository. If a separate review checkout or output is needed, create and use `review/` under the same Task directory.

-**Runtime:** Hermes main session runs the implementation and review loops with local repository tools inside the selected Task directory. Create and use optional `review/`, `cache/`, `tmp/`, `logs/`, or `artifacts/` folders only when the current activity needs them. Repeat environment and real-working-directory preflight in every foreground shell, review checkout, background process, main-session review command, and CI job. Do not use an implementation or review subagent, human-review dependency, or cron to satisfy this gate.
+**Runtime:** Main session implements and reviews inside the selected Task workspace. Load runtime preflight before every execution context and create optional folders only for concrete needs. No implementation/review subagent, human-review dependency or cron.

 **Required work:**

-1. Resolve the real working directory and verify it is inside `<code>-delivery/workspace/<TASK_ID>/`; then verify branch and PR identity, repository state, required tools and committed versions, and required environment-variable names without printing values. For Node/pnpm work, check the resolved `node` and `pnpm` commands and versions. Delivery unit tests use process-local fakes and must not start runtime services; UAT owns resource-dependent testing.
-2. For a defect, write or identify an exact named unit test and show that it fails for the expected product reason before repair. For new behavior, add a failing unit test first when practical and request the required non-unit coverage from UAT. Syntax, tooling, environment, or credentials errors do not count as product evidence.
+1. Load [runtime-and-ci.md](runtime-and-ci.md#execution-context-toolchain-preflight) and pass its exact-context preflight inside the selected Task workspace before commands. Unit tests use process-local fakes, not runtime services; UAT owns resource-dependent testing.
+2. Load `development-method-ttd` and follow mandatory failing-unit-test-first TTD for defects, new behavior and refactors; only an explicitly approved documented exception from the authorized project owner permits departure. Request non-unit coverage from UAT. Tooling, environment and credential failures are not product-test evidence.
 3. Implement only the approved Task, one behavior slice at a time. Keep the diff small, cover normal, edge, and failure behavior, avoid unrelated refactors, and repair forward without reverting valid work.
 4. Run all applicable focused and full unit tests, lint, format checks, typecheck or compile, production build, production dependency audit, static checks, generated-artifact checks, and Delivery-owned Dockerfile/image/container/publication/Helm artifact validations, plus `git diff --check` and repository-state checks. Do not run functional integration, browser, security-boundary, performance, or acceptance suites in Delivery; request and consume those results from UAT.
 5. After local checks pass, commit and push the Task changes without rewriting history. Read back the remote branch and PR and verify that the local checked revision, remote branch head, and PR head are identical.
 6. Hermes main session reviews that exact PR head for logic, security, acceptance coverage, production-path use, and test gaps. Tests alone are not the review. The main session must inspect the complete diff and relevant production paths, record a pass/fail verdict for the exact revision, and remain accountable for that verdict. If review finds a problem, remain in `GATE_003_TASK_IMPLEMENTATION`: repair it on the same Task branch, rerun affected local checks, push the new PR head, and review that exact head again.

-**Exit gate:** Every local command and review used the selected Task workspace, and every optional support folder had a concrete Task need; every acceptance criterion has implementation and test evidence; every required local check passes; the local checked revision, remote branch head, and PR head are identical; and that exact PR head has a passing review with no unresolved logic, security, acceptance, or material test finding. Any later file change keeps or returns the Task to `GATE_003_TASK_IMPLEMENTATION` until affected checks, push/readback, and review pass again. Any failure report names the exact command, file, test, or review finding; observed and expected behavior; failure class; mutation state; and repair or owner.
+**Exit gate:** Task-workspace/preflight rules and all local checks pass; every acceptance criterion has implementation/test evidence; `development-gates` candidate identity matches remote branch/PR and exact-head review has no unresolved finding. Later edits keep/return the Task to `GATE_003_TASK_IMPLEMENTATION` until affected checks, push/readback and review pass. Failure reports use [status-and-reporting.md](status-and-reporting.md): exact command/file/test/finding, observed versus expected behavior, failure class, mutation state and repair/owner.

 ### Stage 4 — `GATE_004_TASK_PR_CI` — Verify and Merge the Task PR

@@ -67,10 +70,10 @@ Hermes may pause the repair loop only when progress requires an unavailable exte

 **Required work:**

-1. Verify that every required Delivery CI job—unit tests, lint, typecheck, build, static security checks, and artifact publication validation—passes on the exact PR head reviewed in `GATE_003_TASK_IMPLEMENTATION` and within one complete successful attempt. Never combine passing jobs from different revisions or attempts.
+1. Apply the loaded `development-gates` attempt-integrity contract to all required Delivery jobs: unit tests, lint, typecheck, build, static security and artifact validation, including the required aggregate.
 2. Immediately before merge, re-read the PR and current application `test`. Confirm that the PR remains open, its head is unchanged, its base is `test`, its branch equals the reviewed PR head, required CI is green, review still matches, the PR is mergeable, and base drift is harmless.
 3. If conflict resolution, rebase, or any file/tree change is required, return to `GATE_003_TASK_IMPLEMENTATION`; repeat affected local checks, push/readback, and review for the new PR head; then restart `GATE_004_TASK_PR_CI` for that exact head.
-4. Merge without rewriting the reviewed PR head. Read back the merged PR and resulting application `test` revision.
+4. Apply the loaded owner’s reviewed-head merge and separate integration readback contract within existing merge authority.

 **Exit gate:** All required PR CI succeeds on the exact reviewed PR head; the final pre-merge check refers to that same head; the PR is merged; and the exact application `test` integration revision is known. The Task remains `IN_PROGRESS`; merge alone does not mean `TO_BE_RELEASED` or `DONE`.

@@ -82,7 +85,7 @@ Hermes may pause the repair loop only when progress requires an unavailable exte

 **Required work:**

-1. Verify every required application unit-test/build job, container build, immutable image publication, registry digest readback, and artifact check on the exact application `test` integration revision. PR-head CI cannot replace post-merge integration evidence.
+1. Apply the loaded owner’s separate integration gate to all required application unit/build, container, immutable publication and artifact checks. Retain registry digest readback; PR-head CI cannot replace integration evidence.
 2. Complete the deployment and handoff evidence contract below, then add the hash-linked `IN_PROGRESS` to `TO_BE_RELEASED` event with the merged application PR, integration revision, successful integration CI, publication and deployment evidence when required, and the UAT handoff or verified non-runtime exception.
 3. Update Ways of Working or Engineering documentation only when this Task changed how the project actually works.
 4. Validate, review, merge, and read back the documentation handoff PR.
@@ -0,0 +1,26 @@
+"""Exact, reversible skill-identity migration; never rewrite provenance URLs."""
+import re
+
+IDENTITIES = {
+    'development-branching-strategy-aerosim': 'development-branching-strategy-skic-aerosim',
+    'development-scripts-aerosim': 'development-scripts-skic-aerosim',
+    'devsecops-ci-cd-gitea-aerosim': 'devsecops-ci-cd-gitea-skic-aerosim',
+    'documentation-docusaurus-aerosim': 'documentation-docusaurus-skic-aerosim',
+    'development-gitops-argo-cd-gondor-v1': 'development-gitops-argo-cd-home-gondor-v1',
+    'home-v1-discord': 'discord',
+    'home-v1--truenas': 'truenas',
+}
+
+def translate(text, mapping):
+    # Bare discord/truenas are common words: only migrate explicit skill identity
+    # delimiters (inline code, quoted names, and related_skills list entries).
+    pattern = r'(?P<left>`|[\"\'])(?P<name>' + '|'.join(map(re.escape, mapping)) + r')(?=[`\"\'\],])'
+    text = re.sub(pattern, lambda m: m['left'] + mapping[m['name']], text)
+    return re.sub(r'(?m)^(    related_skills: \[)(.*)(\])$',
+                  lambda m: m[1] + ', '.join(mapping.get(v, v) for v in m[2].split(', ')) + m[3], text)
+
+def canonicalize(text):
+    return translate(text, IDENTITIES)
+
+def original_identity(text):
+    return translate(text, {new: old for old, new in IDENTITIES.items()})
@@ -0,0 +1,77 @@
+[
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^5\\. After local checks pass,.*$",
+    "hashes": [
+      "e4e6ae6f894fdb0b5dc1779b7037c39eb476ee80620f93a253c4a68ea4adabd1"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^6\\. (?:The active executor|Hermes main session) reviews.*$",
+    "hashes": [
+      "63acb91e7391daac3af378032e4842ef7da6d03ff1f1939016180f9fffb5f86c"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^2\\. Immediately before merge,.*$",
+    "hashes": [
+      "fb6968a7bea4662e945ca914c53988cc1d9d72b02681384f7041a89ad347c229"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^3\\. If conflict resolution,.*$",
+    "hashes": [
+      "6052be5ba307b088499acdc0abcecbea36719695f423e6e9b888027d85867e89"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^\\*\\*Exit gate:\\*\\* All required PR CI.*$",
+    "hashes": [
+      "ff18fe3b523dae671eb14f513e1f90700eeea9c8a93bf85686f67b8f9635e7f3"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^\\*\\*Exit gate:\\*\\* Every required post-merge.*$",
+    "hashes": [
+      "9338b15f03aa46139240842a0c72c92fd3af2d91e1af4ee82c55fe859361d196"
+    ]
+  },
+  {
+    "path": "references/task-delivery-gates.md",
+    "pattern": "^### Stage [1-6].*$",
+    "hashes": [
+      "50a5e09da6aca1488d9d375c22740b39c0168837bde39bb390352186f7982d6d",
+      "fc758ac75b342cceb555b927710c0aba38ca31fd6bdbca4eb7ed054f814c2f38",
+      "f68e0313b622ef7666bccd0c6bd9551153e01e2b8f6cc68978a4dda72924c45a",
+      "156eb690576a1a812c3fb7d32ee32fb98c174c81143830a336ca4ec54dd27745",
+      "4a76eda13fa68c5f28b458d5d1ad400211c4daad5418b3f3319c36b84ade03b2",
+      "960be6948de8a23e4591cfa099c9cf30e47f2b1b72f8702f05c6d7dd1713bfd7"
+    ]
+  },
+  {
+    "path": "references/status-and-reporting.md",
+    "pattern": "(?s)## Scope Status Vocabulary.*",
+    "hashes": [
+      "0aa256d5852c664c0d18b3888990d6c31e73a4e50e894324e1d11cb72a970b93"
+    ]
+  },
+  {
+    "path": "references/failure-and-documentation.md",
+    "pattern": "(?s)When a build or CI failure is observed:.*?(?=5\\. )",
+    "hashes": [
+      "d7850a4ca34226dd9b45badc1623012e87a2557f3cced4b63807939be00a72f5"
+    ]
+  },
+  {
+    "path": "references/failure-and-documentation.md",
+    "pattern": "(?s)7\\. run local validation;.*?(?=## Documentation Ownership)",
+    "hashes": [
+      "13e74d3dd90a757a7a7d0ef7f0a4448cb6a7764b7c63ce8699b40f197fbac6fa"
+    ]
+  }
+]
@@ -0,0 +1,97 @@
+{
+  "owners": {
+    "preflight": {
+      "owner": "development-scripts",
+      "reference": "references/runtime-preflight.md",
+      "source_url": "https://gitea.lego-cloud.eu/global-skills/development-scripts",
+      "inspected_head": "0e36552938da94c0539e39b35256b8effe34c25d",
+      "sha256": "07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462",
+      "state": "merged source and installed reference byte-identical; authenticated immutable full-package readback verified",
+      "evidence_text": "# Exact-context toolchain preflight\n\nUse before repository commands in a Node/pnpm repository, or any command that may invoke Node or pnpm. This is a reusable execution procedure, not a project directory convention or permission to run tests. The caller supplies the authorized repository, revision, worker context, required environment names and permitted operation. Task-directory containment and stop-on-failed-preflight remain caller responsibilities.\n\n## Required inputs\n\nLoad `development-monorepo-pnpm` and its `references/workspace-and-tooling.md` tooling reference for version selection and committed toolchain/workspace conventions. Resolve required Node and pnpm versions from the repository's **committed toolchain contract**, not ambient executables. Inspect the selected revision's package-manager pin, Node declaration and applicable locked environment/image metadata. Do not invent a universal version or workspace layout. If declarations conflict, are absent, or leave the required exact version unresolved, stop and reconcile the contract with its owner before running the requested command. A version range alone is not an exact observed-version pin.\n\n## Procedure\n\nTreat every foreground shell, detached worktree, background process, main-session review command and CI job as a separate execution context. A successful check elsewhere is not transferable evidence. Perform inspection/preflight in the intended context before the requested repository operation; inspection commands themselves are necessary to establish the context.\n\n1. Resolve the required versions from the committed toolchain contract at the expected source revision. Record the paths/revision used, not secret content.\n2. Inside that exact shell/process/container run `command -v node`, `node --version`, `command -v pnpm`, and `pnpm --version`, using `terminal` or the equivalent job step. Require every command to succeed; compare observed versions to the resolved required versions (normalize only Node's leading `v`). An executable found in a different shell is not sufficient. Record executable paths and observed/required versions.\n3. Verify required non-secret environment variable names are present, including disposable-test database markers when applicable, **without reading or printing their values**. For Bash, a presence-only `[[ -v VARIABLE_NAME ]]` check is suitable after validating a supplied name against `[A-Za-z_][A-Za-z0-9_]*`. Do not dump `env`, expand indirect values, enable tracing, or read credentials. Presence alone does not prove resource isolation or authorize database use; that remains the caller's separate gate.\n4. Verify the actual working directory and repository root; compare source HEAD and linked branch/PR identity with caller-supplied expected identity. Inspect repository state and confirm it is clean or intentionally staged, with every intentional change accounted for. Detached HEAD is allowed only when it matches the authorized revision/worktree. Never reset/stash unrelated changes to make a check green. Do not assume a project-specific application layout.\n5. Start the original command only after every applicable check passes. Keep activation, verification and execution in the same context. Recheck if PATH, activation, working directory, revision, image or required environment changes. A background worker must do its own preflight within its launch command, not consume a foreground success flag.\n\n## Failure and repair\n\nNever assume a background process inherits `PATH`, shell activation, Devbox state, Corepack activation, database variables or other exports from a foreground terminal. Missing `pnpm` is an execution-context/toolchain failure, **never an application-code or test failure**. Missing Node, wrong versions, wrong working directory/revision and absent required names also block execution; they do not constitute product RED.\n\nRepair the exact context by providing the required toolchain path or approved activation. Do not silently install a latest toolchain, rewrite pins, or execute Devbox unless the parent workflow permits it. Then **repeat the complete preflight** there and rerun the original command before making a claim about repository code. Preserve failure and rerun evidence separately.\n\n## Verification and scope\n\nRecord expected/observed versions, executable paths, repository root/revision, branch/PR link, approved state, presence-only results, context identity and command outcome. Do not include secrets or environment values. Local narrow validation never replaces all-app CI or exact-head remote job evidence. Toolchain success is not a claim of CI, publication, deployment or runtime acceptance.\n\nRun the owner contract regression with `terminal(command=\"python3 scripts/test_preflight_contract.py\", workdir=\"<skill-repository>\")`. This checks maintained guidance, not a live consumer toolchain; the five steps above must still be exercised for each real conLine truncated
+    },
+    "base_images": {
+      "owner": "devsecops-ci-cd-gitea",
+      "reference": "references/base-images.md",
+      "source_url": "https://gitea.lego-cloud.eu/global-skills/devsecops-ci-cd-gitea",
+      "inspected_head": "669e28eadfe79ac7cb3c10ccdea318dd5296d481",
+      "sha256": "1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53",
+      "state": "merged source and installed reference byte-identical; authenticated immutable full-package readback verified",
+      "evidence_text": "# Reusable CI base-image contract\n\nUse when stable runtimes or OS tools would otherwise be downloaded repeatedly in application jobs. This owner defines reusable construction, validation, publication and consumption mechanics; it does not choose a project's image repository, branch, application layout or runtime-smoke authority. Supply those bindings from the project Delivery/CI overlay. Runtime verification is a separate acceptance layer delegated to the project's authorized runtime-test owner, not permission granted by this reference.\n\nRead [pipeline-workflow.md](pipeline-workflow.md) for trust boundaries, exact checkout and immutable retries, and [harbor-auth.md](harbor-auth.md) for credential handling. These safeguards apply in addition to this contract; base-image work is not an exemption.\n\n## Construction and static contract\n\n1. Keep one folder per image containing a Dockerfile, machine-readable version/platform metadata, usage documentation, a build helper and a static publication contract. Record required upstream reference, platforms, runtime/tool pins, numeric user/group and supported workspace path. Do not prescribe a product's application directories.\n2. Pin the upstream base by digest (`repository@sha256:<64 lowercase hexadecimal characters>`). Check the actual resolved platform against metadata; for a multi-platform index, record index and platform-manifest relationships rather than silently comparing unlike digests.\n3. Assert exact runtime/tool versions, architecture, numeric non-root identity, writable workspace, CA trust, Git, shell and every other required tool. Static/unit checks inspect Dockerfile and metadata; they cannot alone prove live writability, effective UID, trust or executable behavior. The authorized runtime verifier must exercise those assertions on the **published digest** and record results separately. Never describe a static declaration as runtime proof.\n4. Prefer the verified job image over repeated `actions/setup-node` or package-manager bootstrap steps. Keep `pnpm install --frozen-lockfile --ignore-scripts` in the application repository for lockfile parity; do not bake project dependencies or credentials into a generic base image. This does not waive the consumer's committed toolchain contract or exact-context preflight in `development-scripts/references/runtime-preflight.md`.\n\n## Candidate isolation and trusted publication\n\n- Build and perform static/unit validation on pull requests **without registry credentials**. Credential absence must be structural: no publication secret in workflow-global scope, candidate job environment, persistent runner home, Docker config, build args, cache or artifact. Skipping login does not remove an already available credential. Use an approved credential-free base acquisition path; if unavailable, stop rather than leak publication credentials to candidates.\n- Choose exactly one configured default integration branch, as in the pipeline owner (`test` or `main`), and publish only its exact trusted integration commit. PR, fork, branch-readiness and broad tag triggers cannot publish. Separately authorized release workflows must retain equivalent isolation, never broaden the ordinary candidate path.\n- Complete candidate execution before introducing a narrowly scoped Harbor robot secret in the isolated trusted publication job. Pass secrets via standard input only. Keep temporary Docker/Helm credential stores scoped to the job, clean on success and failure, and treat logout failure on persistent runners as failure after cleanup. Never pre-seed push credentials into the reusable job image or execute untrusted candidate hooks after authentication.\n\n## Immutable publication and direct readback\n\n1. Verify checkout identity before building. Tag the image with the full 40-character source revision; never publish `latest`, mutable version aliases or shortened SHAs for governed consumption. Enforce registry immutable-tag rules as well as workflow checks.\n2. Preserve the validated local image ID. Existing tags are reusable only when the remote OCI config digest equals that validated local image ID; different content is a hard failure, not an overwrite. For multiple platforms, verify each required platform's config identity and expected manifest/index membership. Missing or ambiguous remote evidence fails closed.\n3. After publication, read back the Harbor artifact directly: verify reference, source identity, platform and manifest digest. Record source URL/revision, workflow run/attempt/job, immutable tag, manifest digest, config digest/local image ID and canonical millisecond ISO-8601 UTC timestamp. Config digest is for retry content comparison; manifest digest is for consumption. Do not interchange either with source SHA or chart archive checksum.\n4. Require the final aggregate under `always()` to explicitly require every necessary build/publication/readback job's success. A green push step or skipped aggrLine truncated
+    }
+  },
+  "moved_clauses": [
+    {
+      "clause": "version resolution, executable/version comparisons",
+      "owner_key": "preflight",
+      "section": "Required inputs; Procedure 1\u20132"
+    },
+    {
+      "clause": "presence-only environment and repository identity/state checks",
+      "owner_key": "preflight",
+      "section": "Procedure 3\u20134"
+    },
+    {
+      "clause": "same-context activation, inheritance failure classification and complete retry",
+      "owner_key": "preflight",
+      "section": "Procedure 5; Failure and repair"
+    },
+    {
+      "clause": "image folder/metadata, digest/tool/platform/user/workspace/trust assertions and lockfile parity",
+      "owner_key": "base_images",
+      "section": "Construction and static contract"
+    },
+    {
+      "clause": "credential-free candidates and isolated trusted publication",
+      "owner_key": "base_images",
+      "section": "Candidate isolation and trusted publication"
+    },
+    {
+      "clause": "full-source tags, direct Harbor readback, immutable retry and aggregates",
+      "owner_key": "base_images",
+      "section": "Immutable publication and direct readback"
+    },
+    {
+      "clause": "digest consumer verification and forward repair mechanics",
+      "owner_key": "base_images",
+      "section": "Consumer verification and forward repair"
+    },
+    {
+      "clause": "negative trigger/tag/secret/interpolation/digest/setup regression cases",
+      "owner_key": "base_images",
+      "section": "Fail-closed regression matrix"
+    }
+  ],
+  "retained_local": [
+    "every foreground shell",
+    "detached worktree",
+    "background process",
+    "worker",
+    "Hermes main-session review command",
+    "CI job",
+    "Stop on failed preflight",
+    "selected Task directory",
+    "selected repository",
+    "allowed command scope",
+    "complete repository CI",
+    "last known-good digest",
+    "trusted `test` branch",
+    "UAT",
+    "exact PR-head SHA"
+  ],
+  "superseded_golden_rules": [
+    {
+      "path": "references/runtime-and-ci.md",
+      "pattern": "(?s)### Per-project reusable CI base images\\n.*?(?=### Gondor)",
+      "hashes": [
+        "0c92e0521c57c357a62c8313c70527547427d98b7647ec8cd1a97c148b5ba4f1"
+      ]
+    },
+    {
+      "path": "references/runtime-and-ci.md",
+      "pattern": "(?s)Treat every foreground shell.*?(?=### Immutable|### Per-project)",
+      "hashes": [
+        "8df9d2e952a6a8c48fd3d0a18357aea21d5ffbb1e06e53c7273c6e50e2545be5"
+      ]
+    }
+  ]
+}
@@ -39,7 +39,7 @@ class LessonsContract(unittest.TestCase):
    def test_contract_1(self):
        text = (ROOT / 'SKILL.md').read_text()
        self.assertIn('<code>-uat', text)
-        self.assertIn('version: 1.14.1', text)
+        self.assertIn('version: 1.15.0', text)

    def test_stage_five_scope_and_authority(self):
        text = (ROOT / "references/task-delivery-gates.md").read_text()
@@ -0,0 +1,47 @@
+"""Canonical bindings preserve owners and original checksum sensitivity."""
+from pathlib import Path
+import hashlib
+import re
+import subprocess
+import unittest
+from canonical_identity import IDENTITIES, canonicalize, original_identity
+ROOT = Path(__file__).resolve().parents[1]
+
+class CanonicalIdentity(unittest.TestCase):
+    def test_exact_identity_and_dependency_count(self):
+        current = (ROOT / 'SKILL.md').read_text()
+        baseline = subprocess.check_output(['git', 'show', 'HEAD:SKILL.md'], cwd=ROOT, text=True)
+        def deps(text):
+            return re.search(r'related_skills: \[(.*?)\]', text)[1].split(', ')
+        expected = [IDENTITIES.get(v, v) for v in deps(baseline)]
+        self.assertEqual(deps(current), expected)
+        self.assertEqual(len(expected), 18 if ROOT.name.endswith('aerosim') else 12)
+        self.assertEqual(len(set(expected)), len(expected))
+        self.assertIn('corp-v1-glossary', expected)
+        self.assertFalse(set(expected) & set(IDENTITIES))
+
+    def test_mapping_is_reversible_and_not_a_general_rewrite(self):
+        self.assertEqual(len(IDENTITIES), len(set(IDENTITIES.values())))
+        for old, new in IDENTITIES.items():
+            text = f'Load `{old}`; skill_view(name="{old}"); https://example/{old}; /opt/data/{old}/'
+            mapped = canonicalize(text)
+            self.assertIn(f'`{new}`', mapped)
+            self.assertEqual(original_identity(mapped), text)
+        text = 'tags: [corp-v1, discord, channel] /opt/data/corp-v1-aerosim-delivery/ gondor-v1-aerosim-dev'
+        self.assertEqual(original_identity(text), text)
+
+    def test_golden_normalization_still_detects_policy_mutation(self):
+        for old in IDENTITIES:
+            baseline = f'Load `{old}` before mutation; stop if unavailable.'
+            canonical = canonicalize(baseline)
+            digest = lambda t: hashlib.sha256(original_identity(t).encode()).hexdigest()
+            self.assertEqual(digest(canonical), digest(baseline))
+            self.assertNotEqual(digest(canonical.replace('stop', 'continue')), digest(baseline))
+
+    def test_no_legacy_operational_loads(self):
+        for path in [ROOT / 'SKILL.md', *ROOT.glob('references/*.md')]:
+            text = path.read_text()
+            self.assertEqual(canonicalize(text), text, str(path))
+
+if __name__ == '__main__':
+    unittest.main()
@@ -12,7 +12,7 @@ REFERENCES = {
    "development-branching-strategy": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-branching-strategy",
    "development-monorepo-pnpm": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-monorepo-pnpm",
    "development-scripts": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-scripts",
-    "development-gitops-argo-cd-gondor-v1": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1",
+    "development-gitops-argo-cd-home-gondor-v1": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1",
 }


@@ -30,5 +30,5 @@ def test_generic_automation_is_owned_by_development_scripts() -> None:


 def test_gitops_reference_requires_one_environment_per_repository() -> None:
-    assert "development-gitops-argo-cd-gondor-v1" in RUNTIME
+    assert "development-gitops-argo-cd-home-gondor-v1" in RUNTIME
    assert "one repository per environment" in RUNTIME
@@ -0,0 +1,55 @@
+"""Full-program consolidation: owner routing and retained policy safeguards."""
+from pathlib import Path
+import unittest
+from canonical_identity import original_identity
+ROOT=Path(__file__).resolve().parents[1]
+def read(p): return (ROOT/p).read_text()
+class FullProgram(unittest.TestCase):
+    def test_exact_owner_loads_replace_duplicate_algorithms(self):
+        p=read('references/planning-artifact-reconciliation.md')
+        for s in ['skill_view(name="development-gates")','skill_view(name="development-integrity")','exact Task row','historical','no second Focus-admission','run_number','head.ref']:
+            self.assertIn(s,p)
+        self.assertNotIn('Require each matching task to report',p)
+        self.assertLess(len(p.encode()),5000)
+        g=read('references/task-delivery-gates.md')
+        self.assertIn('skill_view(name="development-gates")',g)
+        self.assertNotIn('first when practical',g)
+        self.assertNotIn('seven project channels',g)
+        self.assertIn('A02/A04',g)
+        for i in range(1,7): self.assertIn(f'GATE_{i:03}_',g)
+    def test_storage_and_ttd_decision_loads(self):
+        r=read('references/runtime-and-ci.md')
+        self.assertIn('references/gondor-retained-application-storage.md',r)
+        self.assertIn('before storage design or mutation',r.lower())
+        self.assertNotIn('before fixing when practical',r)
+        self.assertIn('development-method-ttd',r)
+        self.assertIn('isolated, unpublished experimental delta',r)
+        self.assertIn('historical missing RED',r)
+        self.assertNotIn('5. implement the smallest safe fix;\n6. add/update tests',read('references/failure-and-documentation.md'))
+        self.assertIn('last known-good digest',r)
+        self.assertIn('every foreground shell',r)
+    def test_clause_disposition_covers_program_without_inventing_resolution(self):
+        p=read('FULL-PROGRAM.md')
+        for i in range(1,19): self.assertIn(f'| A{i:02} |',p)
+        for s in ['1563064779772526616','unresolved','installed','publication','A02','A04','A06','A08','A17']:
+            self.assertIn(s,p)
+    def test_original_protected_clauses_remain_exact(self):
+        import re, json, hashlib
+        for rule in json.loads((Path(__file__).parent/'full-program-preserved.json').read_text()):
+            matches=re.findall(rule['pattern'],original_identity(read(rule['path'])),re.M)
+            self.assertEqual([hashlib.sha256(m.encode()).hexdigest() for m in matches],rule['hashes'],rule['path']+' '+rule['pattern'])
+    def test_project_specific_boundaries(self):
+        if not (ROOT/'references/single-subagent-task-delivery.md').exists(): return
+        w=read('references/single-subagent-task-delivery.md')
+        self.assertNotIn('│   ├── playwright/',w)
+        self.assertNotIn('│   ├── postgresql/',w)
+        self.assertIn('belong to UAT',w)
+        g=read('references/task-delivery-gates.md')
+        self.assertIn('per Task',g)
+        self.assertNotIn('or start the next Task before',g)
+        c=read('references/gitea-actions-policy.md')
+        for s in ['skill_view(name="devsecops-ci-cd-gitea-skic-aerosim")','references/pipeline-workflow.md','CI / Branch Readiness','CI / Pull Request Validation','CD / Test Artifact Publication','publication','UAT','all applications']:
+            self.assertIn(s,c)
+        self.assertNotIn('## 1. Non-default branch',c)
+        self.assertLess(len(c.encode()),3200)
+if __name__=='__main__': unittest.main()
@@ -0,0 +1,39 @@
+"""Moved owner mechanics and retained caller authority, independently runnable."""
+from pathlib import Path
+import hashlib
+import json
+import unittest
+ROOT = Path(__file__).resolve().parents[1]
+class OwnerConsolidation(unittest.TestCase):
+    def test_owner_evidence_and_clause_mapping(self):
+        manifest=json.loads((Path(__file__).parent/'owner-consolidation-manifest.json').read_text())
+        self.assertEqual(len(manifest['superseded_golden_rules']),2)
+        self.assertEqual(len(manifest['moved_clauses']),8)
+        for owner in manifest['owners'].values():
+            self.assertEqual(hashlib.sha256(owner['evidence_text'].encode()).hexdigest(),owner['sha256'])
+            self.assertEqual(len(owner['inspected_head']),40)
+        for move in manifest['moved_clauses']:
+            text=manifest['owners'][move['owner_key']]['evidence_text']
+            for heading in move['section'].split('; '):
+                self.assertIn('## '+heading.split(' 1')[0].split(' 3')[0].split(' 5')[0],text)
+        pre=manifest['owners']['preflight']['evidence_text']
+        for term in ['command -v node','pnpm --version','without reading or printing their values','linked branch/PR identity','repeat the complete preflight','never an application-code or test failure']:
+            self.assertIn(term,pre)
+        base=manifest['owners']['base_images']['evidence_text']
+        for term in ['without registry credentials','full 40-character source revision','shell interpolation','wrong upstream or consumer digests','pnpm install --frozen-lockfile --ignore-scripts','numeric non-root identity','CA trust','last known-good digest']:
+            self.assertIn(term,base)
+    def test_exact_decision_loads_and_local_boundaries(self):
+        text=(ROOT/'references/runtime-and-ci.md').read_text()
+        manifest=json.loads((Path(__file__).parent/'owner-consolidation-manifest.json').read_text())
+        for owner in manifest['owners'].values():
+            self.assertIn('skill_view(name="'+owner['owner']+'", file_path="'+owner['reference']+'")',text)
+        for clause in manifest['retained_local']:
+            self.assertIn(clause,text)
+        for clause in ['before every repository operation','Node/pnpm repository','CORP_V1_','publication/install','immutable owner revision','forward only','replacement image and consuming workflow pass exact-head CI']:
+            self.assertIn(clause,text)
+        self.assertNotIn('neither owner currently replaces',text)
+        self.assertNotIn('1. resolve the repository-required Node',text)
+        self.assertNotIn('- Keep one folder per image',text)
+        repo='corp-v1-aerosim/corp-v1-aerosim-base-images' if ROOT.name.endswith('aerosim') else 'corp-v1-<code>/corp-v1-<code>-base-images'
+        self.assertIn(repo,text)
+if __name__=='__main__': unittest.main()
@@ -0,0 +1,54 @@
+"""Offline bounded simplification contract; no dependency or network mutation."""
+from pathlib import Path
+import hashlib
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+class SimplificationContract(unittest.TestCase):
+    def test_retained_safety_sections(self):
+        for (path, start, end), digest in SECTIONS.items():
+            text = (ROOT / path).read_text().split(start, 1)[1]
+            if end:
+                text = text.split(end, 1)[0]
+            self.assertEqual(hashlib.sha256(text.encode()).hexdigest(), digest, (path, start))
+
+    def test_dependencies_unchanged(self):
+        self.assertIn(DEPS, (ROOT / 'SKILL.md').read_text())
+
+    def test_unresolved_gates_and_safety_files_unchanged(self):
+        for name, digest in PROTECTED.items():
+            self.assertEqual(hashlib.sha256((ROOT / name).read_bytes()).hexdigest(), digest, name)
+
+    def test_decision_point_loads(self):
+        for name, markers in {
+            'SKILL.md': ['Before login, load', 'skic-skills/channel-board-skic', 'version: 1.15.0'],
+            'references/runtime-and-ci.md': ['Before login, load', 'Load `development-method-ttd`', 'Load `development-monorepo-pnpm`'],
+            'references/status-and-reporting.md': ['Before reporting, load', 'home-v1-skills-code-agent/development-integrity'],
+            'references/planning-artifact-reconciliation.md': ['corepack enable --install-directory', 'Before reporting, load'],
+            'references/failure-and-documentation.md': ['Before authoring or validating documentation, load', 'home-v1-skills-code-agent/corp-v1-glossary'],
+        }.items():
+            for marker in markers:
+                self.assertIn(marker, (ROOT / name).read_text(), (name, marker))
+
+    def test_no_helper_or_reference_removed(self):
+        self.assertEqual({p.name for p in (ROOT / 'references').glob('*.md')}, REFERENCES)
+        self.assertNotIn('SIMPLIFICATION.md', (ROOT / 'SKILL.md').read_text())
+
+    def test_retained_reporting_and_planning_guards(self):
+        status = (ROOT / 'references/status-and-reporting.md').read_text()
+        for marker in ['wave-previous:', 'List every Task', 'GATE_003_TASK_IMPLEMENTATION', 'status unverified', 'exact failed command']:
+            self.assertIn(marker, status)
+        planning = (ROOT / 'references/planning-artifact-reconciliation.md').read_text()
+        for marker in ['complete successful job inventory including aggregates', 'run_number', 'semantics', 'If the PR merged or closed', 'no second Focus-admission', 'configured silent response']:
+            self.assertIn(marker, planning)
+
+    def test_operational_size_reduction(self):
+        paths = [ROOT / 'SKILL.md', *ROOT.glob('references/*.md')]
+        self.assertLess(sum(len(p.read_bytes()) for p in paths), BASELINE_BYTES)
+
+DEPS = '    related_skills: [channel-board-skic, discord, documentation-docusaurus, corp-v1-glossary, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-home-gondor-v1]'
+PROTECTED = {'references/repository-entry-and-visibility.md': 'f040d6f57c4ec5faf4527296f7f71a751fab2153809e2dbe20c90cf2d582a77d', 'references/aerosim-lessons-review.md': '03873d038f146e28ea648c95f7c2e32d2648d1b5eaa963fb635980fe6e814514'}
+REFERENCES = {'task-delivery-gates.md', 'common-pitfalls.md', 'failure-and-documentation.md', 'runtime-and-ci.md', 'repository-entry-and-visibility.md', 'aerosim-lessons-review.md', 'planning-artifact-reconciliation.md', 'status-and-reporting.md'}
+SECTIONS = {('references/runtime-and-ci.md', '## Channel-owned workspace', '## Shared Corp'): '48d1e74b737db691ec31ac593400d59abc7d4eed4cd67b2f12f8a428a48034b5', ('SKILL.md', '## Authority and Escalation', '## Evidence Requirements'): 'e3c566055d9d04d3ab0286e6e5035a8c30f66a81b17b4d0379e8010dead3fa83'}
+BASELINE_BYTES = 84789
@@ -0,0 +1,45 @@
+"""Run every unittest, standalone test function and main-style contract."""
+from pathlib import Path
+import importlib.util
+import inspect
+import json
+import re
+import subprocess
+import sys
+import unittest
+ROOT=Path(__file__).resolve().parents[1]
+TESTS=Path(__file__).resolve().parent
+sys.path.insert(0, str(TESTS))
+suite=unittest.TestSuite()
+modules=[]
+for path in sorted(TESTS.glob('test_*.py')):
+    spec=importlib.util.spec_from_file_location('verify_'+path.stem,path)
+    assert spec is not None and spec.loader is not None
+    module=importlib.util.module_from_spec(spec)
+    sys.modules[spec.name]=module
+    spec.loader.exec_module(module)
+    modules.append(module)
+    suite.addTests(unittest.defaultTestLoader.loadTestsFromModule(module))
+result=unittest.TextTestRunner(verbosity=1).run(suite)
+if not result.wasSuccessful(): sys.exit(1)
+standalone=0
+for module in modules:
+    for name,fn in inspect.getmembers(module,inspect.isfunction):
+        if name.startswith('test_') or name=='main':
+            fn()
+            standalone+=1
+files=[ROOT/'SKILL.md',*sorted(ROOT.glob('references/*.md'))]
+links=0
+for path in files:
+    for link in re.findall(r'\]\(([^)]+)\)',path.read_text()):
+        if '://' in link or link.startswith(('#','<')): continue
+        target=link.split('#')[0]
+        if target:
+            assert (path.parent/target).exists(),(path,link)
+            links+=1
+subprocess.run(['git','diff','--check'],cwd=ROOT,check=True)
+before=sum(len(subprocess.check_output(['git','show','HEAD:'+str(p.relative_to(ROOT))],cwd=ROOT)) for p in files)
+after=sum(p.stat().st_size for p in files)
+ref_before=before-len(subprocess.check_output(['git','show','HEAD:SKILL.md'],cwd=ROOT))
+ref_after=after-(ROOT/'SKILL.md').stat().st_size
+print(json.dumps({'package':ROOT.name,'unittest':result.testsRun,'standalone':standalone,'total':result.testsRun+standalone,'local_links':links,'diff_check':'passed','operational_bytes_before':before,'operational_bytes_after':after,'reference_bytes_before':ref_before,'reference_bytes_after':ref_after},indent=2))
Author	SHA1	Message	Date
jarvis-at-skic	65e546c448	refactor: implement governed Delivery program contracts	2026-10-23 06:39:27 +00:00
jarvis-at-skic	c306ea4794	Merge pull request 'refactor: implement bounded Delivery existing-owner simplification' (#13 ) from refactor/delivery-existing-owners into test	2026-10-22 22:16:23 -07:00
jarvis-at-skic	de2e201c4e	refactor: simplify Delivery through existing procedure owners	2026-10-23 05:12:21 +00:00
jarvis-at-skic	225ae3b068	Merge pull request 'docs: canonical SKIC channel skill naming' (#12 ) from docs/canonical-skic-reference-names into test	2026-10-21 10:58:12 -07:00